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Abstract 

Multiple  Model  Adaptive  Estimation  (MMAE)  is  a  method  of  estimating  unknown  system 
parameters  by  modeling  all  possible  parameter  configurations  in  several  modeb.  The  parameters  for 
this  research  are  failure  status  conditions  associated  with  flight  control  actuators  and  sensors  on  the 
LAMBDA  Unmanned  Besearch  'Vehicle,  an  experimental  aircraft  operated  by  Wright  Laboratory 
Flight  Controls  Division,  Flight  Controls  Techniques  Branch  at  Wright-Patterson  Air  Force  Base, 
Ohio.  Six  actuator  failures  and  eight  sensor  failures  are  modeled,  along  with  the  fully  functional 
aircraft,  in  fifteen  elemental  Kalman  filters.  These  filters  propagate  and  update  their  own  aircraft 
state  estimates  in  real  time.  A  probability  computation  representing  the  likelihood  of  each  elemental 
filter’s  match  to  the  true  condition  of  the  aircraft  is  used  to  generate  relative  probabilities  for  each 
filter’s  hypothesis.  In  this  research,  the  MMAE  algorithm  is  extended  for  the  identification  of 
dual  failures  through  the  use  of  a  hierarchical  structure  of  filter  banks.  The  ability  of  the  MMAE 
to  identify  dual  failures  in  the  face  of  wind  gust  uncertainty  and  sensor  noise  is  investigated. 
Aircraft  state  excitation  is  required  for  effective  MMAE  performance.  Therefore,  the  form  of 
an  optimal  input  dither  signal  is  derived  through  extensive  experimentation.  Dither  signals  are 
applied  to  the  command  inputs  of  a  Quantitative  Feedback  Theory  (QFT)  flight  control  system 
which  controls  pitch  rate,  roll  rate,  and  sideslip  angle.  In  particular,  the  MMAE  performance  is 
studied  as  sinusoidal  dither  inputs  are  varied  in  frequency  and  magnitude.  An  analysis  of  tuning 
techniques  for  the  elemental  filters  within  the  MMAE  is  presented.  The  monitoring  of  scalar 
residuals  associated  with  controlled  aircraft  states  is  presents  with  respect  to  its  effect  on  MMAE 
performance. 
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Multiple  Model  Adaptive  Eatimation  Applied  to  the  LAMBDA  URV 
for  Fhiluie  Detection  and  Identification. 


/.  Introduction 

The  problem  of  fault  detection  and  isolation  in  aircraft  control  systems  has  been  and  will 
continue  to  be  a  major  engineering  challenge.  The  engineer  is  faced  with  a  delicate  balancing  act. 
He  is  constantly  trading  effectiveness  for  simplicity  and  exchanging  redimdancy  for  weight  savings. 
The  subject  of  this  thesis  will,  when  developed,  become  a  key  tool  in  the  design  of  aircraft  that 
will  push  performance  beyond  what  is  conceived  as  possible  today.  The  multiple  model  adaptive 
estimation  algorithm  has  the  potential  to  replace  many  redundant  aircraft  components  that  require 
space  and  consume  energy.  It  would  be  highly  desirable  to  exchange  those  components  for  a  small 
portion  of  computer  resources  allocated  to  running  a  fault  detection  algorithm. 

In  this  thesis.  Multiple  Model  Adaptive  Estimation  (MMAE)  is  being  appUed  to  failure  de¬ 
tection  and  isolation  in  sensors  and  flifd^t  control  actuators.  Specifically,  a  multiple  model  adaptive 
estimation  algorithm  is  employed  to  detect  these  failures  on  the  LAMBDA  URV  (Unmanned  Re¬ 
search  Vehicle)  as  simulated  in  a  computer  model.  The  MMAE  algorithmic  structure  is  shown  in 
Figure  1.1.  The  measurement,  z,  and  knowledge  of  the  control  input  are  presented  to  each  Kalman 
filter  in  the  active  bank  of  Kalman  filters  which,  in  turn,  produce  their  own  unique  state  estimates, 
icfc,  and  residuals,  rt.  The  residuals  are  combined  to  form  probabilities  of  correctness,  pj^,  associ¬ 
ated  with  each  filter.  These  probabilities  weight  the  individual  state  estimates  appropriately  and 
their  sum  is  the  probability-weighted  average  MMAE  state  estimate. 

Several  failures  will  be  synthesized  in  a  truth  model  to  produce  a  database  of  control  inputs 
and  sensor  measurements.  The  MMAE  algorithm  will  employ  a  bank  of  Kalman  filters,  each  driven 
by  a  model  which  simulates  one  of  the  possible  failed  conditions.  Expected  measurements  from 
each  Kahnan  filter  will  be  compared  with  the  database  of  true  measurements.  Then  the  filter  with 
the  best  match  between  expected  and  true  measurements  is  declared  to  correspond  to  the  model 
that  mirrors  the  truth  model. 
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Figure  1.1  Multiple  Model  Filtering  Algorithm.  Rqiroduced  from  [ll:p.l32]. 

Our  first  objective  is  to  build  on  the  work  of  Capt  Peter  Hanlon  [3]  by  extending  the  single 
failure  isolation  that  he  accomplished  to  dual  failure  isolation.  The  second  objective  of  equal 
importance  is  to  find  and  develop  optimum  test  inputs  known  as  dithers.  Dithering  is  required  to 
excite  the  dynamic  responses  of  the  aircraft  system  so  that  the  measurements  of  these  responses 
may  be  analysed  by  the  MMAE  algorithm.  Thus,  an  optimum  dither  pattern  will  enhance  the 
detection  and  isolation  performance  of  the  MMAE  algorithm. 

1.1  Problem  Statement 

The  problem  at  hand  centers  on  the  automatic  detection  of  and  compensation  for  failed 
control  surface  authority  and  jQight  data  sensor  degradation.  The  situation  arises  as  a  result 
aircraft  battle  damage  or  in-flight  equipment  malfunction.  Although  the  results  of  such  frulures 
will  often  be  catastrophic  with  high  performance  aircraft,  there  are  some  configurations  of  failures 
that  would  allow  the  aircraft  to  continue  flying  if  only  a  controller  designed  for  that  specific  situation 
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vrere  put  on-line.  A  solution  to  this  problem  will  automatically  and  correctly  identify  the  failed 
component(8)  and  select  the  proper  controller.  In  this  thesis  we  will  H>pfy  ^  Multiple  Model 
Adaptive  Estimation  algorithm  to  the  problem  of  failure  detection  and  isolation. 

Multiple  Model  Adaptive  Estimation  is  an  algorithm  used  to  estimate  states  and  parameters 
in  a  dynamic  system  [11].  Parameters  are  quantities  that  describe  the  constrained  physical  char¬ 
acteristics  of  the  system  and  are  usually  constant  over  a  short  range  of  time.  The  dynamic  stsites 
which  do  vary  appreciably  over  this  short  time  are  estimated  using  a  Kalman  filter  designed  around 
a  mathematical  model  which  holds  the  parameters  as  true  constants.  In  the  real  world,  parameters 
themselves  have  dynamic  properties.  However,  they  vary  so  slowly  that  their  values  are  taken  to  be 
constant  when  discussing  the  behavior  of  the  dynamic  states.  While  Kalman  filtering  estimates  the 
values  of  dynamic  states  assuming  known  parameter  values,  MMAE  seeks  to  identify  the  changes  in 
parameters  as  well.  Numerous  techniques  have  been  developed  to  identify  parameters  in  dynamic 
systems  of  all  types.  Many  of  these  rely  on  schemes  to  converge  upon  a  parameter  value  by  seeking 
out  the  true  value  whatever  it  may  be.  The  computational  cost  of  theses  methods  is  high.  On 
the  other  hand,  MMAE  presents  a  refined  set  of  hypothesised  parameter  possibilities  and  attempts 
to  match  measurements  taken  fixsm  the  true  system  to  measurements  predicted  by  one  of  these 
possibilities. 

1.2  Continuation  of  AFIT  Research 

In  1992,  Capt  Hanlon  completed  his  thesis  on  the  application  of  MMAE  to  the  LAMOBDA  URV 
[3].  He  established  the  validity  of  previoiisly  established  MMAE  characteristics  for  single  failures 
[15,  19,  21,  22]  and  improved  the  algorithm  for  quicker  and  more  decisive  convergence.  A  major 
obstacle  for  Hanlon  was  that  the  LAMBDA  model  he  used  did  not  have  a  closed  loop  controller 
(see  Appendix  A  for  a  description  of  the  LAMBDA  URV).  Therefore,  the  automatic  feedback  that 
would  normally  provide  continuous  correction  inputs  did  not  exist.  Since  the  open-loop  system  is 
unstable,  this  made  the  failure  identification  problem  much  more  challenging. 

Our  work  in  this  thesis,  the  second  application  of  MMAE  to  the  LAMBDA,  differs  from 
Hanlon’s  in  a  few  significant  areas.  The  first  two  concern  the  LAMBDA  model.  The  remadning 
differences  are  in  research  objectives  which,  of  course,  aim  to  btuld  on  the  previous  work. 
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l.t.i  Updated  LAMBDA  ataie  apace  model  from  Wri^  Laboratoriea.  Data  collected 
from  recent  fli^t  tests  has  led  to  the  development  of  a  more  accurate  state  space  representation 
of  the  LAMBDA  URV  [26].  Stability  derivatives  used  in  the  LAMBDA  model  for  this  research  are 
closer  representations  of  its  true  dynamic  behavior  than  those  used  in  Hanlon’s  work  and  are  listed 
in  Tables  A.l  and  A.2.  A  new  state  space  LAMBDA  model  [26]  representing  both  longitudinal 
and  lateral  dynamics  was  obtained  from  Capt  S.  Sheldon  of  the  Wright  Laboratory  Flight  Controls 
Division,  Flight  Controls  Techniques  Branch.  This  model  is  discussed  in  Subsection  3.2.1. 

1.2.2  Cloaed  Loop  Controller.  A  robust  closed  loop  controller  has  been  obtsdned  from 
Wright  Laboratories.  This  controller  is  the  result  of  a  Quantitative  Feedback  Theory  (QFT)  design 
[26]  and  is  implemented  in  low  order  difference  equations  foimd  in  Appendix  C.  The  command 
inputs  are  pitch  rate,  roll  rate,  and  sideslip  ai^e.  Prefilters,  rate  feedback,  and  cascade  compen¬ 
sators  are  used  in  each  of  the  control  loops.  A  washout  filter  is  included  in  the  yaw  rate  feedback 
loop.  A  more  thorough  presentation  and  diagram  are  found  in  Subsection  3.2.2. 

1.2.S  Dither  Technique.  In  order  for  an  MMAE  algorithm  to  identify  failures  in  a  dynamic 
system,  the  modes  of  that  system  must  be  excited.  Only  when  known  inputs  are  allowed  to  provoke 
a  response  is  the  algorithm  able  to  determine  if  a  degradation  in  control  authority  or  sensing 
capability  has  occurred.  This  known  input  is  called  a  dither  input. 

A  primary  goal  of  this  research  is  to  find  an  optimal  input  dither  technique.  Optimal  is 
defined  in  this  case  to  be  a  balance  between  system  identification  and  subliminality.  The  latter 
quality  refers  to  our  desire  to  keep  the  magnitude  of  the  dither’s  dynamic  response  so  low  that  the 
pilot  is  imaware  that  his  aircraft  is  undergoing  an  automatic  test. 

Hanlon  found  that  the  best  dither  had  frequmcy  characteristics  in  consonance  with  the  natural 
mo-  -  3  of  the  aircraft.  He  studied  the  eigenvalues  of  the  continuous  time  model  to  arrive  at  an 
effective  oscillation  frequency  [3:p.36].  The  present  research  will  build  on  his  work  by  testing  other 
dither  formats.  These  will  include  sine  waves,  doublets,  and  triangle  waves.  Concentration  will  be 
on  defining  the  optimal  magnitude  and  frequency  of  sine  wave  dithers. 

1.2.4  Dual  Failure  Detection  and  Identification.  Previous  work  with  the  LAMBDA  model 
concluded  that  MMAE  was  effective  at  isolating  single  failures.  The  present  research  aims  to  prove 
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that  a  hierarchical  MMAE  atructure  [14, 15, 16, 17,  21,  22]  is  effective  in  identifying  dual  foihires. 
The  machinations  of  MMAE  are  the  same,  the  real  difference  lies  in  the  initial  failure  hjrpotheais. 
With  single  failure  detection,  the  initial  hypothesis  is  always  a  fully  functional  system.  The  MMAE 
filter  bank  consists  of  filters  which  hypothesise  either  a  fully  functional  system  or  only  one  failure. 
The  dual  failure  hierarchy  will  start  the  same  way.  In  addition,  once  a  single  failure  is  identified, 
the  system  re-initialises  with  the  single  failure  hypothesis  filter  as  the  initial  hypothesis.  The  bank 
of  on-line  filters  changes  to  those  that  hypothesise  either  only  that  single  failure  or  two  failures, 
one  of  which  is  the  first  failure  that  has  already  been  detected.  In  addition,  a  fully  functional  filter 
is  kept  on-line  in  case  of  a  mis-identification  of  the  first  declared  failure.  This  allows  the  algorithm 
to  revert  to  the  condition  in  which  the  initial  h3rpothesis  is  a  fully  functional  system.  Such  a 
case  is  described  more  fully  in  Subsection  5.3.  Beseardi  will  demonstrate  the  MMAE  algorithm  is 
convergent  to  the  correct  dual  failure  status  and  will  portray  the  time  required  to  make  the  correct 
failure  declaration. 

J.S  MMAE  Background 

In  the  introduction,  the  reader  was  given  a  general  description  of  what  Multiple  Model  Adap¬ 
tive  Estimation  is  and  how  it  is  applied  to  our  problem.  Here  we  will  establish  the  mathematical 
basis  for  a  multiple  model  algorithm.  However,  the  research  of  this  thesis  is  not  limited  to  the 
mathematical  development.  Important  terms  and  concepts  are  defined  presently  so  that  the  reader 
may  have  a  more  thorough  vmderstanding  of  why  they  are  altered  to  suit  our  research. 

l.S.l  Kalman  Filter  Equations.  A  thorough  understanding  of  the  Kalman  filter  update 
and  propagation  equations  is  an  essential  background  for  the  reader.  For  reference,  the  equations  are 
restated  here.  Consider  the  continuous  linear  system  represented  by  the  linear  stochastic  difference 
equation  with  state  vector  x  >.ud  control  input  vector  u. 


x(ti+i)  =  ^{ti+i,ti}x(ti)  +  B^itiMU)  +  Ga(l<)w<(fi)  (1.1) 


and  the  discrete  time  measurements  modeled  by 


2(t<)  =  H(«<)x(ti)  -I-  v(li) 


(1.2) 


Sans  serif  font  is  used  for  x,  Uf4,  x,  and  v  to  denote  the  foot  that  these  are  random  processes 
as  opposed  to  real-valued  variables,  which  are  expressed  in  Times  Rxnnan  font.  W4(tj)  and  v(ti) 
are  sero-mean  white  Gaussian  noise  processes  that  are  independent  of  each  other  and  that  have 
covariance  kernels  given  by 

(t,)}  =  Q4(£*)«i,  (1.3) 

(1.4) 

where  6ij  is  the  Kronecker  delta,  defined  to  be  one  if  its  subscripts  are  the  same  and  sero  otherwise. 
R(ti)  is  positive  definite  for  all  ti.  Q4(tt)  i>  positive  semidefinite  and  related  to  Q  and  G  of  the 
continuous-time  model  by  [10:p.l71]: 

Qs(<i)  =  I  *  ♦(«*+!, T)G(T)Q(T)G’*'(T)*’‘(ti+i,T)dr  (1.5) 

Jti 

This  underlying  continuous-time  model  for  which  Equation  (1.1)  is  an  equivalent  discretetime 
model  is  given  by 

x(t)  =  P(t)x(t)  -i-  B(t)u(l)  -H  G(t)w(t)  (1.6) 

where  w(t)  is  sero-mean  white  Gaussian  noise  with  covariance  kernel: 

£{»(«)»''(<  +  ’•)}  =  QWW  (1.7) 

where  S{t)  is  the  Dirac  delta  function.  The  state  transition  matrix  ^{ti+i,ti)  in  Equations  (1.1) 
and  (1.5)  is  the  solution  to 

♦(t,t,)  =  F(t)*(t,t<)  (1.8) 

♦(ti,t<)  =  I  (1.9) 

The  optimal  state  estimate  at  time  ti  before  incorporating  the  measurement  at  that  time 

is  denoted  by  x(tf ),  while  the  corresponding  estimate  after  the  measurement  update  is  denoted 
by  x(tf ).  The  state  estimate  and  its  covariance  matrix,  P(t,~ ),  have  initial  conditions  Xo  and  Po 
at  time  to  and  are  propagated  forward  from  time  ti_i  to  time  ti  by  the  discrete  time  propagation 
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eqnmticnM  [10:pp.l71-172]: 


i(|r)  =  (110) 

P(«r)  =  Q-(ti-i)Q4(<*.i)Gj(^_0  (1.11) 

where  is  related  to  the  input  transfonnation  midriz  B  of  the  cootiimons-tiine  model,  Equa¬ 
tion  (1.6),  by  [10:p.l71]: 

♦(t*+x,T)B(T)dr  (1.12) 

Ju 

Finally,  because  the  discrete  time  model  of  Equation  (1.1)  is  derived  from  a  continuous-time  model 
[10:p.l75] 

G^(ti)  =  I  (1.13) 

The  propagated  optimal  state  estimate  and  its  covariance  matrix  are  then  updated  with 

information  from  the  current  measurement  a^  weighted  according  to  a  Kalman  filter  gain  K(f«). 


The  update  equationa  are  [10:p.217]: 

K(«,)  =  P((,-)H*(fc)  [H(«,)P(ir)H’'(«,)  +  E(»,)] "  (1.14) 

x(<t)  =  x(<.-)  +  K(<,)  -  H(<i)*(ir)l  (l  l«) 

P(<f )  =  P(«.-)  -  K((i)H((i)P(l.-)  (1.16) 

1.S.2  Deveiopment  of  the  MulUpte  Modtd  Adaptive  Estimation  Algorithm.  The  problem 


addressed  by  multiple  model  filtering  model  is  that  of  devrioping  a  state  estimate  and  parameter 
estimate,  given  a  time  history  of  measurements  and  applied  control  inputs.  The  system  dynamics 
are  modeled  by  a  linear  stochastic  difference  equation  as  in  Equation  (1.1)  and  the  available  mea¬ 
surements  are  modeled  as  in  Equation  (1.2).  A  vector,  a,  of  uncertain  parameters  in  the  model 
may  have  an  impact  on  any  or  all  of  B^,  H,  Q^,  and  R.  In  this  research,  a  is  a  scalar  and  its 
discrete  point  values  are  associated  with  the  specific  failure  status  of  the  vehicle. 

Our  objective  is  to  find  a  hypothesis  conditional  probability  pfe(ti)  that  will  give  an  indication 
of  how  well  a  model  based  on  parameter  vector  value  su  matches  the  measurements  produced  by  a 
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■yttem  based  on  pamneter  vector  a,-.  If  Jt  =  j,  the  probability  shoiild  ideally  be  1.  More  generally, 
we  want  to  know  the  probability  that  the  uncertain  parameter  a  assumes  the  value  a^,  given  a 
measurement  history  up  to  the  current  time  U: 


PiW  s  prob{«  =  atlZCli)  =  Zj} 


(1.17) 


where  Z(tj)  is  the  history  of  measurements  of  the  form  given  by  Equation  (1.2)  up  to  time 


2{ti)  = 


*(*i) 

*(«a) 


(1.18) 


When  the  measurement  random  process  takes  on  a  realised  value,  the  time  history  of  measurements 
becomes  known  implicitly  and  is  represented  by 


2i  = 


«a 

•i 


(1.19) 


Since  we  are  going  to  define  an  on-line  algorithm,  we  would  like  the  e3q>ression  for  Pk(ti)  to  be 
recursive:  the  current  calculation  is  based  only  on  the  results  of  the  prior  sample  time  and  the  new 
inputs  at  the  current  time.  A  development  given  in  [ll:pp.l29-132]  results  in 


(1.20) 


where  Sj  is  the  actual  realisation  of  measurements  at  time  ti.  Equation  (1.20)  is  a  recursive 
expression.  We  need  only  to  resolve  expressions  for  the  probability  densities.  The  probability  of 
realising  measurement  s«  at  time  ti,  given  that  we  already  have  a  history  of  measurements  through 
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time  ti_i,  Zi.i,  and  we  am  cooiidering  only  one  asinmed  eahie  ci  the  vector  of  parametere,  n^: 


{■}  =  {-5'?(«.)A;‘(‘.)r.(‘.)}  (l») 

The  reeidtiale,  rt,  are  the  difiSerencee  between  actnal  meaeiiremente  and  predicted  meararements  in 
a  Kalman  filter  based  on  the  assumed  parameter  value  a*: 

=  (IM) 

where  the  superscript cm  t,~  denotes  the  instant  in  time  before  the  Kalman  filter  update  occurs. 
The  residuals  are  easily  computed  from  the  incoming  measurements,  a(t«),  and  the  state  estimate 
which  is  produced  by  that  Kalman  filter.  The  residual  is  anticipated  to  have  covariance  A*  which 
is  calculated  as  in  Equation  (1.24): 


At  =  HftPiTHj  +  a*  (1.24) 

where  is  the  steady  state  value  of  Pk(t,~ ). 

l.S.S  Beta  Dominance.  The  leading  coefficient  of  the  probability  density  function  given 
by  Equaticm  (1.21)  is  a  scaling  term.  Known  as  the  0  term,  its  fimcticm  is  to  make  the  area  under 
the  density  fimcticm  equal  to  unity.  Note  in  particular  that  the  cme-half  power  of  the  determinant  of 
the  residual  covariance  matrix,  |  Ak|^ ,  is  a  multiplier  on  the  probability.  The  probability  associated 
with  elemental  filter  k  depends  on  the  magnitude  of  |Aft|  for  that  elemental  filter.  The  problem  is 
that  |Afe|  tends  to  be  small  for  filters  based  cm  the  assumpticm  of  a  sensor  failure  because  a  total 
sensor  failure  manifests  itself  as  a  row  of  seros  in  the  H  matrix.  Since  A^  is  given  by  Equaticm  (1.24), 
this  would  result  in  a  smaller  than  usual  residual  covariance  associated  with  that  failed  sensor  filter. 
If  the  terms  given  by  Equation  (1.22)  were  the  same  for  all  elemental  filters  in  the  MMAE  (i.e.,  for 
all  k),  one  would  desire  all  at  values  to  be  declared  ecpially  likely.  However,  under  these  ccmditions, 
the  0  term  will  cause  higher  pi,  values  to  be  associated  arith  those  hypotheses  that  correspcmd  to 
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lower  |Ak|  values.  Thus,  false  alarms  on  Mnsor  failures  are  more  likely  to  result.  This  effect  is 
called  fi  dominance. 

In  fact,  it  has  been  proven  that  false  alarms  on  sensor  failures  do  result  when  a  probability 
density  of  the  form  given  by  Equation  (1.21)  is  used  [3,  12,  14,  15,  16,  17,  21].  Therefore,  in 
our  research,  P  dominance  will  be  avoided  from  the  onset  by  eliminating  altogether  the  leading 
coefficient  in  Equation  (1.21),  as  suggested  and  evaluated  by  [3, 12, 14, 15, 16, 17,  21). 


i.S.4  Scalar  Rendaal  Monitoring.  Probabilities  generated  by  the  MMAE  algorithm  give 
a  sense  of  relative  "correctness”  associated  with  each  elemental  lUter.  Very  often  the  situation  will 
arise  in  which  two  filters  may  have  probabilities  that  are  nearly  equal,  even  though  only  one  is  the 
correct  filter.  This  confounds  the  identification  process  and  unless  more  information  is  obtained, 
two  filters  will  improperly  share  recognition  as  the  correct  filter. 

Each  probability  is  developed  from  the  sum  of  products  of  scalar  residuals.  The  term 
rJ(tj)Aj|'^(ti)rk(ti)  in  Equation  (1.22)  may  be  broken  down  into  its  scalar  components  to  gain 
more  insight  into  exactly  which  scalar  measurement  does  not  agree  with  a  filter-predicted  measure¬ 
ment.  This  can  be  used  to  enhance  isolation  of  individual  sensor  failures.  Consider  the  following 
example  system  resulting  from  a  three  element  residual: 


r  = 


rt 

*•3 

**3 


An  expansion  in  scalar  components  yields 


>•3 


=  -I- -I- riAaaV 

2rir2Ai2  +  +  2r2r3A^ 


(1.25) 


(1.26) 


(1.27) 
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Note  that  a  large  lingle  element  of  r  has  the  same  effect  on  probability  as  moderate  magnitudes 
of  all  elements  of  r  (see  Equations  (1.22),  (1.21),  and  (1.20)).  Also,  recall  that  rJ{ti)Al^(ti)rk{ti) 
is  simply  scaled  to  generate  {•}  in  Equation  (1.22). 

Residual  monitoring  is  a  means  of  capitalising  on  the  large  quick  changes  in  a  single  scalar 
element  of  while  the  remaining  elements  exhibit  their  previous  average  characteristics.  This 
technique  is  most  effective  in  identifying  sensor  failures.  A  functional  sensor’s  measurement  is 
characterised  by  a  non-sero  dynamic  mean  (due  to  the  useful  signal)  with  sensor  noise  added. 
Upon  failure,  the  mean  will  go  to  sero  or  some  constant  bias.  At  that  time  the  Kalman  filter 
continues  to  estimate  the  sensor  state  based  upon  its  internal  model  and  prior  measurements.  This 
estimate  will  vary  significantly  from  the  current  measurement  which  is  based  on  nothing  but  noise. 
Hence,  a  large  step  change  will  be  seen  in  the  residual  (if  the  prior  measurements  were  not  near 
sero).  The  Kalman  filter  will  continue  to  present  state  estimates  based  in  part  on  the  internal 
model  which  is  responding  to  the  applied  dither.  As  time  goes  on,  predicted  measurements  from 
the  Kalman  filter  are  being  subtracted  from  sero-mean  noise  to  form  the  scalar  residual  which,  in 
turn,  oscillates  according  to  this  dither. 

Scalar  residual  monitoring  is  useful  in  the  following  situation.  Assume  that  there  is  some 
ambiguity  about  whether  sensor  j  has  failed.  There  are  two  techniques  available  to  resolve  this 
ambiguity.  (1)  Look  at  the  scalar  residual  for  sensor  j  in  any  elemental  filter  except  that  which 
assumes  a  failed  sensor  j.  If  that  scalar  residual  is  bigger  than  anticipated,  we  have  corroborating 
evidence  that  sensor  j  ha*  failed.  (2)  If  the  scalar  residual  for  sensor  j  in  the  filter  that  does 
assume  sensor  j  has  failed  is  bigger  than  anticipated,  we  have  a  corroborating  vote  that  sensor  j 
ha*  not  failed.  Additionally,  keep  in  mind  that  if  the  hypothesis  of  an  elemental  filter  is  correct, 
all  scalar  residuals  in  that  filter  should  be  white  and  sero-mean.  However,  if  the  hypothesis  is 
wrong,  the  dither  appUed  to  the  system  will  appear  in  the  residuals  because  of  the  effect  on  the 
true  measurements.  These  residuals  are  not  properly  compensated  by  the  estimated  measurement, 
Hfc(t{)xfe(tf  ),  in  Equation  (1.23),  as  noted  before.  Such  signals  are  readily  detected  and  useful  for 
hypothesis  testing  decisions. 

Thus,  the  behavior  of  a  single  scalar  element  of  r  provides  insight  beyond  the  information 
found  in  the  scalar  quantity  rJ(ti)At  ^(tj)rjk(t«)  alone.  If  the  behavior  of  scalar  residuals  were 
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studied,  insight  such  as  this  could  help  to  design  an  algorithm  that  converges  quickly  to  a  onrect 
failure  identification  while  the  MMAE  algorithm  is  only  able  to  resolve  the  failure  to  two  possible 
failures. 

1.3.5  Filter  Tuning.  There  are  two  opposing  forces  in  the  design  of  the  Kalman  filters 
used  in  the  MMAE  scheme.  The  first  is  that,  as  engineers,  we  want  to  limit  the  number  of  failure 
status  possibilities.  This  means  that  we  want  a  coarsely  discretised  parameter  space.  The  other 
force  is  our  desire  to  estimate  the  degree  to  which  a  failure  has  occurred.  A  finely  discretised 
parameter  space  would  serve  our  purposes  here.  The  link  between  a  modeled  point  in  parameter 
space  mid  an  unmodeled  point  in  parameter  space  is  made  by  toning  the  Kalman  filter  associated 
with  the  modeled  point. 

We  would  like  to  have  the  MMAE  algorithm  declare  an  elevator  actuator  failure  (or,  even 
better,  a  partial  failure)  even  if  it  is  still  10,  50,  or  evmi  75  percent  effective.  On  the  other  hand, 
we  don’t  want  the  algorithm  to  identify  a  pitch  rate  sensor  failure  falsely  when  the  true  failure  is 
on  an  elevator  actuator.  The  balance  is  struck  by  carefully  tuning  each  Kalman  filter  with  respect 
to  all  others. 

Another  feature  of  the  MMAE  algorithm  is  the  ability  to  Mend  failure  hypotheses  by  weight¬ 
ing  individual  filter  states  according  to  their  respective  MMAE  filter  probabilities.  Rather  than 
finely  discretizing  the  parameter  space  to  allow  a  range  of  partial  failures  to  be  hypothesized  in 
various  elemental  filters  as  described  above,  partial  failures  may  be  detected  with  a  coarsely  defined 
parameter  space  coupled  with  this  blending  action.  For  instance,  the  MMAE  might  model  only  the 
fully  functional  aircraft  and  fully  failed  sensors  or  actuators,  and  by  placing  substantial  probability 
weight  on  the  fully  functional  aircraft  filter  and  the  fully  failed  elevator  filter,  it  could  correctly 
indicate  a  certain  percentage  loss  of  that  actuator.  With  this  approach,  both  advantages  of  finding 
the  degree  of  failure  and  of  employing  the  least  number  of  filters  are  realized. 

1.4  Hierarchictd  Modeling  Structure 

The  MMAE  is  capable  of  identifying  only  a  limited  number  of  failures.  This  limit  is  tied 
directly  to  the  number  of  on-line  filters.  If  a  failure  occurs  which  is  not  modeled  in  an  on-line  filter, 
the  MMAE  algorithm  will  not  identify  it,  though  it  may  indicate  that  some  failure  did  occur. 
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We  with  to  identify  the  failuie  ttatiit  of  Jf  =  14  individual  components  in  our  research.  If 
we  sought  to  identify  single  failures,  only  if  +  1  or  15  filters  would  be  required  to  remain  on-line. 
That  is,  we  would  run  one  filter  for  each  hypothesised  failure  plus  one  filter  for  the  fully  functional 
aircraft  hypothesis.  Identification  of  multiple  failures  requires  individual  Kalman  filters  for  each 
combination  of  possible  failures.  Our  research  is  limited  to  dual  failures,  which  would  require  the 
generation  of  1  -I-  K  +  K!/((K  -  2)!2!)  or  106  filters  representing  no  failure,  single  failures,  and  dual 
failures. 

Even  though  106  possibilities  exist,  we  must  limit  the  number  of  filters  kept  on-line  at  any 
given  time.  The  overriding  factor  is  that  106  Kalman  filters  running  simultaneously  will  require 
computational  power  beyond  conceivable  capacity.  A  second  factor  is  that  probabilities  generated 
by  MMAE  are  shared  between  the  on-line  filters.  The  more  filters  there  are  on-line,  the  more  the 
probabilities  are  “watered  down”.  This  makes  convergence  to  one  filter  hypothesis  less  likely.  The 
solution  is  to  utilize  a  hierarchical  structure  of  filter  banks. 

The  hierarchical  bank  structure  features  one  bank  of  active  filters  and  several  banks  on 
standby,  ready  to  be  loaded  into  the  processor  and  brought  on-line  at  any  time.  See  Figure  1.2. 
The  initial  on-line  bank  at  Level  0  includes  the  fully  functional  filter  and  all  single  failure  filters. 
Filters  at  Level  0  remain  active  as  long  as  the  MMAE-generated  probability  remains  with  the  fully 
functional  filter.  Upon  detection  of  a  single  failure,  the  MMAE  probability  shifts  to  the  single 
failure  filter  corresponding  to  that  failure.  All  other  single  failure  filters  are  removed  and  a  new 
bank  of  double  failure  filters  is  loaded  and  activated.  The  new  bank  includes  only  those  dual  failure 
filters  that  represeni,  the  failure  already  detected  plus  one  more  failure.  The  fully  functional  filter 
remains  on-line  as  a  back-tracking  path  in  case  of  a  false  initial  failure  identification.  The  single 
failure  filter  for  the  initial  failure  also  remains  on-line  and  carries  the  highest  probability  until  a 
second  failure  occurs.  At  this  point,  the  probability  shifts  to  the  corresponding  dual  failure  filter. 
For  our  purposes  of  detecting  and  identifying  only  two  failures,  no  new  bank  is  loaded  to  look  for 
a  third  failure. 
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Level  0 


Level  1 


Figure  1.2  Hierarchical  Multiple  Mot'el  Filtering  Structure. 


1.5  Research  Objectives 

There  are  two  primary  objectives  to  this  research.  One  is  to  develop  a  dithering  technique  that 
satisfies  specifications  of  subliminality  and  of  sufficient  system  excitation  for  failure  identification. 
The  other  is  to  prove  that  a  hierarchical  structure  is  capable  of  isolating  at  least  two  failures 
correctly,  without  false  alarms,  and  in  minimal  time.  Before  pressing  on  to  these  objectives,  we 
must  re- verify  the  results  of  Hanlon’s  work  [3]  in  light  of  the  differences  discussed  in  Sections  1.2.1 
and  1.2.2  concerning  the  updated  LAMBDA  model  and  the  addition  of  a  closed  loop  controller. 

Specific  research  questions  are  posed  in  italics. 

1.5.1  Develop  Best  Dither.  As  mentioned  in  Section  1.2.3,  the  ability  of  the  MMAE 
algorithm  to  identify  specific  failures  is  directly  related  to  the  method  used  to  excite  the  dynamic 
modes  of  the  aircraft. 
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Wh(U  it  the  form  of  the  dither  inpet  that  cantet  the  qnichett  convergence  of  the  MMAE 
algorithm  to  a  correct  failure  hypoAetisf 

The  speed  of  detection  is  emphasised  here  but  a  correct  failure  hypothesis  must  be  reached 
without  false  alarms  or  missed  alarms,  if  possible. 

What  magnitude  of  lateral  and  vertical  g-forcet  would  be  considered  to  be  "sMiminal"  to  the 
aircrew? 

The  subliminality  of  p-forces  is  a  subjective  issue.  A  real  answer  to  this  qi^tion  is  found 
through  physiological  research  to  determine  a  human’s  sensitivity  to  p-forces.  This  thesis  does 
not  intend  to  address  such  questions  as,  “What  mi^nitude  of  p-forces  are  noticeable?”,  or  “What 
magnitude  of  p-forces  are  annoying?”  Therefore,  the  subliminality  question  has  been  addressed 
strictly  through  library  research  [1,  15,  20]. 

What  it  the  best  balance  between  siMimintdity  and  failure  identification  time? 

The  magnitude  of  dither  inputs  is  bounded  on  the  low  side  by  failure  identification  time 
constraints  and  on  the  high  side  by  subliminality  constraints.  Hopefully,  we  will  find  that  the  low 
bound  is  lower  than  the  high  bound.  If  not,  an  intelligent  trade-off  must  be  made. 

What  format  of  dither  input  will  provide  the  best  overall  performance  in  terms  of  failure 
protection,  aircrew  convenience,  and  comfort? 

Three  formats  are  suggested:  (1)  Automatically  induced  dither  input.  This  is  the  ideal  format. 
There  is  no  aircrew  awareness  or  intervention  and  continuous  failure  protection  is  provided.  (2)  Pilot 
tum-on  and  turn-off  of  automatic  dithering  system.  Continuous  protection  is  not  provided,  but 
this  may  be  a  valid  alternative  if  we  find  that  the  Tnitiimiim  dither  required  for  failure  identification 
is  much  greater  that  the  maximum  subliminal  dither.  Under  such  conditions,  a  pilot  wotdd  want 
the  option  of  being  able  to  turn  the  dither  off  for  certain  periods  of  time.  (3)  Pilot-induced  routine. 
Engineering  studies  produce  an  input  signal  that  is  generated  in  fiight  by  the  pilot  moving  the 
stick  and  rudder  peddles.  The  advantage  here  is  that  the  pilot  always  has  complete  control  of  his 
aircraft,  without  the  “disturbance”  of  an  extonally  generated  dither.  The  disadvantage  is  that 
continuous  failure  protection  is  not  provided. 
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1.5.2  Proof  of  Hierarchical  Concept.  In  Section  1.4,  the  hierarchical  concept  was  devel¬ 
oped  as  a  strategy  of  detecting  and  isolatmg  up  to  two  failures.  Our  goal  is  to  prove  that  this 
concept  is  valid  and  that  it  works  under  conditions  of  noisy  measurement  signals  and  wind  gust 
turbulence. 

Doe»  the  MMAE  hierarchicd-etructured  failare  detection  algorithm  converge  to  the  correct 
dual  failure  hypothesis? 

Does  the  algorithm  converge  to  the  correct  dual  failure  hypothesis  guiddy  enoupk  to  prevent 
incorrect  failure  hypotheses  declarations  or  severely  degraded  control  of  the  aircraft? 

It  is  desired  that  the  algorithm  converge  to  some  dual  failure  hypothesis  under  all  dual  failure 
conditions.  Moreover,  it  should  converge  to  the  correct  dual  failure  hypothesis  to  be  of  any  value. 
Out  research  is  intended  to  show  that,  regardless  of  type  or  order  of  two  failure  occurrences,  the 
algorithm  is  able  to  identify  those  failures  without  false  alarms. 

Is  the  algorithm’s  performance  path-dependent  for  the  identification  of  simultaneous  dual  fail¬ 
ures? 

It  is  true  that  some  specific  types  of  failures  are  more  readily  identified  than  others  [3,  15, 
19,  21].  In  the  case  of  simultaneous  or  near  simultaneous  failures,  the  hierarchical  structure  will 
force  the  algorithm  to  identify  a  single  failure  first,  then  identify  the  second  failure.  We  will  find 
out  if  this  logical  structure  degrades  the  algorithm’s  poformance  in  the  face  of  many  combinations 
of  dual  failures. 

1.6  Scope  of  Research 

All  research  will  be  done  through  computer  simulation.  This  is  valid  since  the  MMAE  algo¬ 
rithm  will  be  implemented  in  a  digital  processor  once  fielded.  Also,  the  updated  LAMBDA  model 
wiU  give  excellent  representation  of  the  aircraft’s  d3rnamics  in  a  digital  simulation. 

The  software  tool  for  this  research  is  an  amalgamation  of  Menke’s  software  and  Hanlon’s 
software  used  in  their  theses,  [15]  and  [3],  respectively.  Menke’s  hierarchically  structured  software 
will  be  used  to  implement  the  dual  failure  scheme.  Hanlon’s  MMAE  software  will  implement  the 
MMAE  algorithm  inside  of  the  hierarchical  structure. 
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The  aircraft  dynamics  will  be  simulated  in  a  state  space  format  in  MATLAB  [8]  to  generate 
truth  model  simulation  data.  This  will  generate  a  measurement  time  history  rector  and  a  control 
input  time  history  vector.  These  vectors  will  be  sent  to  the  MMAE  software  system,  which  is 
implemented  in  FORTRAN.  The  Kalman  filters  of  the  MMAE  system  wiR  have  discrete-time, 
somewhat  reduced-order  versions  of  the  LAMBDA  model  embedded  within  their  structure  in  order 
to  propagate  estimates  from  one  sample  time  to  the  next. 

The  aircraft  equations  of  motion  are  linearised  about  a  nominal  fiight  conditions  given  in 
'Dible  1.1.  These  conditions  represent  the  LAMBDA  in  level  cmise,  a  condition  where  dither 
inputs  would  be  required  to  excite  the  aircraft  dynamics  for  good  MMAE  performance.  Second 


Table  1.1  Nominal  Flight  Conditions. 


Parameter 

S]rmbol 

Value 

Units 

Trim  Velocity 

Uo 

169 

feet /second 

Weight 

mg 

200 

pounds 

Center  of  Gravity 

Xc, 

46.8 

inches 

Pitch  Angle 

do 

0 

degrees 

Dynamic  Pressure 

Q 

30.43 

pounds /feet’ 

order  actuator  dynamics  will  be  included  in  the  state  space  model.  Sensor  dynamics,  however,  are 
neglected.  That  is,  the  d3mamic  states  of  the  state  space  model  are  used  as  vehicle  perturbation 
velocity,  angular  rates,  and  angle  sensor  readings  directly.  The  fiight  control  system  is  implemented 
in  difference  equations  and  provides  stable  closed  loop  control  of  pitch  rate,  roll  rate,  and  sideslip 
angle.  The  flight  control  system  is  described  fully  in  Subsection  3.2.2. 

Failures  for  the  following  set  of  fourteen  aircraft  flight  control  system  components  will  be 
studied.  The  six  actuators  of  interest  are:  right  devator  actuator,  left  elevator  actuator,  right 
aileron  actuator,  left  aileron  actuator,  right  rudder  actuator,  left  rudder  actuator.  In  addition, 
there  are  eight  flight  data  sensors:  velocity  sensor,  angle  of  attack  sensor,  pitch  rate  sensor,  pitch 
angle  sensor,  sideslip  sensor,  roll  rate  sensor,  roll  angle  sensor,  and  yaw  rate  sensor. 

1.7  Limitations 

Even  though  our  research  concerns  the  in-flight  characteristics  of  a  real  aircraft,  our  research 
will  be  limited  to  digital  computer  simulation  only.  Since  no  real  human  pilot  will  be  flying  this 
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aircraft,  we  won’t  be  able  to  teat  the  proposed  ditheri  for  pilot  comfort.  In  the  case  of  the  LAMBDA 
remotely  piloted  vehicle,  pilot  comfort  may  be  defined  as  the  lack  of  annoyance  due  to  dithers  while 
operating  the  joystick  for  remote  control.  As  stated  before,  the  subliminality  limits  on  p-forces 
have  been  determined  through  library  research.  We  must  depend  on  the  findings  of  others  for  our 
definition  of  “subliminal”. 

The  hierarchical  concept  is  designed  to  handle  multiple  failures.  Conceivably,  a  hierarchical 
structure  could  handle  the  one-by-one  failure  of  all  modeled  components.  Our  efforts  are  aimed  at 
proving  the  legitimacy  of  the  hierarchical  concept.  To  do  this,  we  are  employing  only  the  minimum 
structure  required  for  this  proof  -  two  fidlures.  This  should  be  sufficient  since  the  MMAE  algorithm 
is  intended  to  work  the  same  regardless  of  where  in  the  hierarchical  structure  it  is  being  employed: 
an  initial  condition  is  hypothesised  and  all  other  possible  conditions  are  continuously  checked  for 
validity.  Research  done  in  this  thesis  will  demonstrate  that  this  is  the  case. 

1.8  Summary  of  Following  Ckaptera 

This  introduction  chapter  provided  a  statement  of  the  problem,  backgroimd,  and  some  specific 
questions  which  will  be  the  focus  of  our  research.  A  historical  backgrotmd  will  be  provided  in  the 
next  chapter.  The  reader  will  note  that  a  thorough  literature  review  has  been  undertaken  and  that 
the  current  research  effort  falls  in  a  logical  succession  to  those  preceding  it. 

Chapter  m  gives  a  specific  road  map  on  how  our  research  will  be  conducted.  Software  tools 
will  be  described.  Our  implemoxtation  of  the  LAMBDA  dynamics  along  with  its  controller  and 
wind  gust  model  will  be  presented  as  well.  A  presentation  on  the  MMAE  design  specifics  and 
Kalman  filter  designs  will  give  the  reader  detailed  insight  into  the  machiaations  of  our  complete 
system.  Finally,  Chapter  m  concludes  with  an  output  format  description  which  will  be  useful  in 
analysis. 

Chapter  IV  will  be  a  detailed  presentation  of  the  results  of  our  research.  An  analysis  will  be 
presented  in  Chapter  V.  Ken,  answers  to  the  research  questions  posed  in  Section  1.5  will  be  found. 
Finally,  a  conclusion  will  wr&^>  up  the  significant  findings  of  our  work  and  present  ideas  for  future 
research. 
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II.  LUeraiurt  Review 


Through  recent  yean,  several  research  efforts  have  sought  to  prove  the  earlier  claims  that 
Multiple  Model  Ad^;>tive  Estimation  (MMAE)  can  be  used  as  an  effective  algorithm  to  identify 
parameters  (particularly  sensor  and/or  actuator  failure  status)  in  a  flight  amtrol  environment. 
Mathematical  development  was  followed  by  computer  simulation.  Computer  simulation  has  re¬ 
vealed  many  difficulties  in  realising  the  anticipated  potential  of  MMAE.  Though  many  problems 
have  been  solved,  more  research  is  required  to  affirm  controlled  and  stable  operation  in  actual 
flight.  With  the  LAMBDA  Unmanned  Research  Vehicle  (UEV),  the  in-flight  data  needed  as  proof 
of  concept  may  be  obtained  with  minimal  cost  and  essentially  no  threat  to  human  life.  Actual  flight 
testing  is  on  the  horison. 

2.1  Early  Research 

In  1965,  D.  T.  Magill  established  the  mathematical  framewmk  for  MMAE  [6].  He  proposed 
a  set  of  Kalman  filters,  each  based  on  a  different  system  model  based  upon  a  distinct  value  of  a 
parameter  vector.  In  a  Kalman  filter,  the  difference  between  the  measurements  from  the  true  plant 
and  the  predicted  measurements  firom  the  estimated  states  are  known  as  residuals,  r: 

r  =  a  -  Hi”  (2.1) 

If  the  model  in  the  Kalman  filter  is  not  an  accurate  portrayal  of  the  actual  system,  the  predicted 
measurements,  Hx~ ,  will  not  match  the  actual  measurements,  a.  The  residual  gives  information 
about  this  mismatch.  Magill  used  these  residuals  to  produce  a  weighted  sum  of  the  state  estimates 
that  would  be  theoretically  better  than  a  state  estimate  produced  by  a  single  Kalman  filter  based 
on  a  single  presumed  value  for  the  parameter  vector. 

An  excellent  paper  on  the  broader  topic  of  failure  detection  is  by  Willsky  [25].  hi  1976,  he 
gave  an  overview  of  many  methods  used  in  determining  changes  in  plant  parameters.  Noteworthy 
is  his  anticipation  of  the  growth  in  computer  power  that  would  facilitate  implementation  of  several 
of  the  techniques  he  reviews.  He  states  that  accurate  and  reliable  algorithms  will  be  complex  and 
require  modem  parallel  processing  computer  structures.  As  the  complexity  of  algorithms  increases. 
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though,  the  need  for  redundant  hardware  may  decrease.  Thus,  Williky  hat  unTdled  the  secret  for 
perfecting  a  failure  detection  algorithm. 

Williky  points  out  that  an  improvement  in  failure  detection  could  be  obtained  by  studying  the 
characteristics  of  several  failure  modes.  This  would  limit  the  possibilities  of  parameters  to  estimate 
and  give  up*front  information  about  failures  one  would  anticipate.  One  of  the  promising  tediniques 
he  mentions  makes  use  of  a  bank  ci  filters,  each  designed  for  a  specific  failure.  Probabilities 
indicating  a  level  of  truth  for  each  filter’s  hypothesis  are  formed  from  their  respective  residuals. 

The  advent  of  the  F-8C  Digital  Fly  By  Wire  (DFBW)  research  aircraft  presented  the  oppor¬ 
tunity  to  test  computer-driven  fiight  control  algorithms  on  an  airborne  aircraft.  Athans  ef.  al.  [1] 
attempted  to  implement  Multiple  Model  Adaptive  Control  (MMAC)  on  the  F-8C  for  the  purpose  of 
estimating  fiight  conditions.  The  structure  of  an  hfMAC  algorithm  is  similar  to  that  of  Figure  1.1, 
except  that  each  elemental  filter  is  cascaded  with  a  deterministic  optimal  controller  that  accepts 
fok  **  input  and  produces  14  as  an  output,  and  then  thmir  is  generated  as  a  probability-weighted 
average  of  the  Ut’s.  The  authors  were,  in  effect,  estimating  dynamic  pressure  through  an  MMAC 
algorithm  that  did  not  make  use  of  air  data  sensors  which  normally  provide  dynamic  pressure  in¬ 
formation.  Thus,  this  MMAC  adapted  to  a  different  uncertain  parameter  than  the  failure  status 
parameters  of  the  current  research.  A  bank  of  Linear  Quadratic  Gaussian  (LQG)  compensators 
was  set  up  to  cover  the  range  of  possible  fiight  conditions  for  the  F-8C.  Each  compensator  had 
coupled  to  it  a  filter  that  tised  rate  and  acceleration  information  to  develop  a  residual  and  a  state 
estimate.  Each  LQG  compensator  produced  a  control  input  based  on  the  state  vector  presented  by 
its  respective  filter.  All  residuals  were  compiled  in  a  probability  evaluator,  which  in  turn  assigned 
a  probability  weighting  to  each  control  input  from  all  LQG  compensators.  Finally,  a  composite 
ccmtrol  input  was  computed  from  the  weighted  sum  of  all  control  inputs  and  sent  to  the  aircraft 
controk.  An  important  finding  from  this  work  is  the  negative  effect  of  P  dominance  (see  Subsec¬ 
tion  1.3.3)  which  is  treated  in  AFIT  theses  to  be  discussed. 

Dunn  and  Montgomery  [2]  also  made  use  of  the  F-8C  program,  but  the  results  of  their  efforts 
were  limited  to  computer  simulation  in  anticipation  of  better  results  before  attempting  in-flight 
tests.  Their  work  is  related  to  the  current  study  of  failure  detection  in  that  their  system  attempted 
to  estimate  aerodynamic  stability  derivatives.  The  first  point  of  interest  to  us  deals  with  the  dither 
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■ignali  Dunn  and  Montgomery  used  to  itimnlate  the  dynamic  model  of  the  aircraft.  They  found 
that  identifiability  of  parameters  is  enhanced  when  the  amplitude  of  the  test  control  input,  or 
dither,  is  increased.  The  dither  must  have  a  large  enou^  signal  to  noise  ratio  (SNR)  so  that  its 
effect  is  distinct  from  the  disturbances  caused  by  the  atmosphere.  On  the  other  hand,  one  would 
like  this  automatic  test  signal  to  be  subliminal  to  the  pilot.  Hence,  a  balance  between  identifiability 
and  subliminally  must  be  struck.  Secondly,  we  are  interested  to  learn  that  the  estimation  proceu 
may  go  unstable  if  the  dither  frequency  is  too  low.  Also,  if  the  dither  frequency  is  much  above 
those  of  the  aircraft’s  dynamics,  the  sensor  data  will  provide  no  useful  information  for  parameter 
estimation. 


2.2  MMAE  at  the  Air  Force  Institute  of  Technology 

Thesis  work  at  APIT  has  spanned  a  few  years,  and  the  current  research  will  build  directly 
upon  those  efforts.  Donald  Pogoda  [13,  19]  and  Richard  Stevens  [14,  21]  both  applied  Multiple 
Model  Adaptive  Control  algorithms  to  the  STOL  (short  takeoff/landing)  F-15.  Stevens  installed  a 
Command  Generator  IVacker  /  Proportional  plus  Integral  /  Kalman  Filter  (CGT/PI/KF)  controller 
in  each  elemental  controller  to  form  a  bank  of  controllers  that  would  identify  actuator  and  sensor 
failures  on  the  STOL  F-15  and  reconfigured  the  commanded  control  of  the  aircraft  accordingly.  He 
contributed  knowledge  on  the  tuning  of  the  Kalman  filters  in  this  structure.  Each  filter  representing 
a  certain  failure  must  have  a  unique  domain  in  parameter  space.  This  means  that  the  characteristics 
of  residuals  for  a  given  filter  must  be  unique  to  that  failure,  yet  be  responsive  to  partial  failures 
of  that  type  as  well.  Furthermore,  he  identified  the  effect  of  0  dominance  in  his  results,  showing 
that  the  leading  coefficient  of  the  probability  density  function  given  by  Equation  (1.21)  caused  false 
alarms  biased  toward  sensor  failures.  This  is  due  to  the  scaling  of  probabilities  by  the  inverse  of 
the  determinant  of  the  covariance  of  residuals.  Each  residual  has  a  different  covariance,  especially 
those  associated  with  failures  of  sensors,  which  tend  to  be  small,  as  explained  in  Section  1.3.3.  The 
inverse  of  this  covariance  determinant  is  a  multiplier  on  the  probability.  So,  one  can  see  how  sensor 
failures  are  pre-disposed  to  having  a  failure  probability  that  is  higher  than  fully  functional  aircraft 
or  failed  actuator  conditions. 

Later  on,  Menke  [15]  and  Stratton  [22]  developed  MMAE-based  controllers  for  the  VISTA 
F-16.  In  contrast  with  an  MMAC,  an  MMAE-based  controller  uses  the  structure  of  Figure  1.1 
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directly,  and  then  the  x  produced  by  the  MMAE  in  that  figure  U  pasted  to  a  tingle  controller 
to  produce  the  control  u.  This  single  controller  may  be  informed  of  the  best  estimate  of  the 
uncertain  parameter,  a,  and  ada^t  to  that  estimate,  <»  it  may  simply  be  a  sin^  pre-existing 
control  law  (as  for  Menke's  and  Stratton’s  research)  or  an  enhanced-robustness  contitdler  designed 
specifically  to  provide  good  control  despite  parameter  variations.  Menke  [17]  again  demonstrated 
the  importance  of  Kalman  filter  tuning  for  each  elemental  filter  representing  one  type  of  sensm  or 
actuator  failure.  The  state  estimates  from  each  filter  are  weighted  by  a  probability  computation 
which  utilises  residuals  from  each  elemental  filter  to  develop  a  composite  state  estimate  vector.  The 
MMAE  composite  state  estimate  vector  is  sent  to  a  single  controller,  the  VISTA  F-16  fiight  control 
system,  which  produces  a  single  control  input  vector. 

The  importance  of  Menke’s  work  to  the  current  wcxk  is  that  he  studied  a  hierarchical  struc¬ 
ture  of  failure  detection  which  was  able  to  detect  up  to  two  sequential  or  simultaneous  faults. 
Furthermore,  he  performed  an  analysis  of  dither  inputs.  The  qualities  of  these  input  are 

directly  related  to  the  failure  identification  ability  of  the  MMAE  algorithm  [17]. 

Finally,  the  first  application  of  MMAE  to  the  LAMBDA  UEV  was  made  by  Hanlon  [3].  He 
studied  single  actuator  and  sensor  failures  and  established  that  the  algorithm  does  in  fact  converge 
to  a  single  failure  hypothesis.  Again,  he  noted  the  effect  of  dominance,  as  did  his  predecessors. 
Also,  dither  inputs  were  found  to  be  most  effective  when  they  carry  the  natural  frequencies  of 
the  aircraft  dynamics.  Finally,  Hanlon  experimented  with  changes  to  the  coeflicient  of  Ekjua- 
tion  (1.22). 

The  focus  of  the  current  wcurk  is,  of  course,  to  build  on  the  findinga  of  Hanlon  and  Menke 
by  setting  up  a  hierarchical  structure  of  failure  detection  for  the  LAMBDA  URV  and  to  provide 
further  refinement  of  the  dither  techniques  required  for  effective  failure  identification. 

2.S  Chapter  Summary 

A  review  of  important  literature  on  the  topic  of  Multiple  Model  Adaptive  Estimation  has  been 
accomplished.  The  basis  for  MMAE  was  established  in  1965  by  D.  T.  Magill  when  he  proposed 
that  estimated  states  from  several  Kalman  filters  could  be  combined  to  form  a  better  estimate 
of  the  true  states  than  state  estimates  from  only  one  Kalman  filter,  when  faced  with  parameter 


2-4 


1 


uncertainty  in  the  model  upon  which  the  filters  are  bated.  The  F-fiC  digital  fly-by>wire  aircraft 
presented  the  opportunity  to  test  MMAE  (m  an  airborne  aircraft.  As  a  result,  several  important 
conchisions  were  published,  including  the  dFect  of  0  dominance. 

Besearch  at  the  Air  Force  Institute  of  Technology  in  recent  years  has  established  several 
concq)ts  that  improve  the  performance  of  the  MMAE  algorithm.  Extensions  to  Multiple  Model 
Adaptive  Control  have  demonstrated  that  this  algorithm  can  be  used  effectivdy  in  fiight  control 
systems.  Finally,  a  great  deal  of  work  has  been  accomplished  to  identify  characteristics  of  MMAE 
performance  when  minor  modifications  to  the  algorithm  are  installed  in  an  attempt  to  enhance 
failure  identification. 
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III.  Methodology 


In  this  cluster,  we  ettabliih  the  specific  details  of  how  our  investigation  is  to  be  carried 
out.  The  research  is  confined  to  a  study  using  software  took  to  simulate  the  aerodynamic  states, 
fiight  control  system  states,  and  flight  sensor  measurements  of  the  LAMBDA  URV  during  flight 
through  moderate  wind  conditions.  The  flight  information  generated  by  the  software  simulation 
will  be  referred  to  as  the  truth  data.  This  truth  data  is  used  by  the  MMAE  algorithm  imple¬ 
mented  in  FORTRAN,  which  develops  faulure  detection  and  identification  decisions  based  upon  the 
performance  of  its  bank  of  Kalman  filters. 

The  design  of  the  MMAE  algorithm  is  well  established  and  the  code  for  this  thesis  will  be 
a  modified  version  of  Capt  Hanlon’s  FORTRAN  MMAE  program  [3]  which  was  generated  from 
Menke’s  code  [15].  One  important  change  to  Hanlon’s  code  will  be  the  addition  of  a  hierarchical 
structure,  similar  to  that  of  Stevens  [21]  and  Menke  [15],  to  detect  dual  failures  rather  than  just 
single  failures.  Since  the  aircraft  truth  model  is  augmented  with  a  wind  simulation  model,  the 
Kalman  filters  will  have  to  be  tuned  to  account  for  this  injection  of  uncertainty.  The  standard 
procedure  for  tuning  Kalman  filters  in  an  MMAE  system  is  to  compare  residual  tracking  against 
the  standard  deviation  statistic  computed  by  the  filter  for  that  residual.  An  alternate  procedure 
for  Kalman  filter  tuning  is  investigated  in  this  th^s. 

The  test  procedure  will  feature  various  input  dithers  for  enhancing  failure  identification, 
which  wiU  be  applied  to  the  truth  model  simulation  to  generate  truth  data.  The  truth  data  will 
then  serve  as  the  input  to  the  MMAE  algorithm.  Results  of  the  MMAE  will  be  displayed  in 
graphical  format  as  well  as  tabular  data  formatted  for  easy  analysis.  The  goal  is  to  match  changes 
in  dither  characteristics  to  variations  in  MMAE  performance,  with  the  oversdl  objective  being  to 
demonstrate  as  many  correct  identifications  with  as  little  delay  and  as  few  false  alarms  and/or 

t 

ambiguous  declarations  as  possible. 

S.l  Software  Tools 

All  took  used  in  this  study  will  be  either  FORTRAN  programs  [23]  or  MATLAB  programs  [8]. 
MATLAB  is  favored  where  manipulation  of  matrices  and  other  standard  mathematical  functions 
are  prevalent.  Furthermore,  a  distinct  advantage  is  gained  by  using  the  graphical  model  building 
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CApabilitiei  found  in  the  Simulink  tool  [9]  of  MATLAB.  FOBTBAN  is  emjdxqrcd  for  three  rea¬ 
sons.  First,  the  MMAE  code  currently  exists  in  FOBTBAN.  Second,  an  MMAE  algorithm  written 
in  FORTRAN  is  easily  and  efficiently  transferred  to  the  language  used  by  LAMBDA’S 

on-board  computer.  Finally,  the  MMAE  algorithm  will  he  run  literally  thousands  of  times,  and 
efficiently  coded  FORTRAN  will  generate  object  code  capable  of  much  faster  execution  than  MAT- 
LAB  m-iiles  which  are  re-compiled  each  time  they  are  run.  Therefore,  a  great  deal  of  time  will  be 
saved  in  awaiting  test  results  by  using  compiled  FOBTBAN  code. 

3.2  LAMBDA  Model 

LAMBDA  is  an  unmanned  research  vehicle  (URV).  It  resembles  a  large  radio  controlled 
airplane  with  a  wingspan  of  14  feet.  It  is  equipped  with  the  flight  data  sensors  which  we  are 
studying  as  potentially  failed  components.  The  primary  flight  control  surfaces  include  left  and 
right  elevators,  left  and  right  ailerons,  and  left  and  right  rudders.  These,  too,  are  to  be  viewed  as 
potentially  failed  components.  In  addition,  four  flap  surfaces  and  a  throttle  control  are  featured  on 
the  real  LAMBDA  but  not  included  in  our  model.  The  throttle  is  not  included  because,  though 
it  is  a  primary  means  of  flight  control,  it  is  not  part  of  the  flight  control  system.  Rather,  the 
LAMBDA  typically  is  flown  at  full  throttle.  Therefore  a  failed  condition  is  engine  cutoff  which  is 
immediately  followed  by  emergency  landing  procedures,  conditions  obvious  to  any  pilot  without  the 
help  of  an  MMAE  algorithm.  The  flaps  are  not  included  in  the  model  of  our  study  because  they 
are  not  primary  flight  control  surfaces.  Failure  of  a  flap  would  not  cause  a  reconfiguration  of  the 
flight  control  system,  but  its  obvious  effects  would  cause  a  pilot  to  reverse  his  conscious  command 
to  deploy  them.  In  summation,  we  will  be  studying  the  effects  of  the  failure  of  each  of  eight  flight 
data  sensors  and  six  primary  flight  control  actuators. 

The  LAMBDA  is  a  stable  system  in  the  short  poiod,  phugoid,  roll  subsidence,  and  Dutch  roll 
modes.  Its  spiral  divergence  mode  is  unstable  with  a  long  time  constant.  So,  although  its  modes 
are  faster,  this  aircraft  resembles  a  t3rpical  manned  aircraft  in  performance. 

Previous  MMAE  work  using  the  LAMBDA  assumed  no  flight  control  system  [3].  Command 
inputs  went  directly  to  the  actuators  without  being  modified  by  a  flight  control  system.  Capt  S. 
Rasmussen,  WL/FIG,  has  designed  a  Quantitative  Feedback  Theory  (QFT)  controller  which  will  be 
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implemented  in  our  truth  model  [26].  The  addition  of  a  feedback  controller  should  aid  the  MMAE 
algorithm  in  correctly  identifying  failures  because  the  additional  commands  to  the  actuators  should 
provide  natural  dithering  while  rejecting  the  effects  of  wind  gusts.  Moreover,  the  difficulties  in  the 
design  of  the  MMAE  elemental  filters  in  the  previous  research  [3]  due  to  diverse  eigenvalues  of  the 
open  loop  system  (particularly  the  unstable  mode’s  eigenvalue)  should  be  remedied  by  the  feedback 
control  system. 

3.2.1  Truth  Model.  The  aerodynamic  portion  of  the  LAMBDA  is  represented  by  aero¬ 
dynamic  dimensional  derivatives  which  were  generated  from  test  data  of  actual  LAMBDA  fiights. 
This  information  was  obtained  from  Capt  S.  Sheldon,  WL/FIGS  [26]  and  numerical  values  and  def¬ 
initions  may  be  found  in  Appendix  A.  Dimensional  derivatives  are  determined  by  experiment  and 
they  describe  the  change  in  one  aircraft  state  variable  due  to  a  change  in  some  other  aircraft  state 
variable.  The  primed  symbols  distinguish  dimensional  derivatives  from  non-dimensional  derivatives 
which  are  related  to  the  former  by  a  factor  indicating  the  nominal  flight  condition.  Aircraft  state 
variables  are  perturbations  from  nominal  conditions  and,  since  all  nominal  angles  and  rates  except 
velocity  are  sero,  the  state  variables  are  defined  as  follows:  u  -  forward  velocity  perturbation,  a  • 
angle  of  attack,  q  •  pitch  rate,  $  •  pitch  angle,  ^  -  sideslip  angle,  p  -  roll  rate,  ^  -  roll  angle,  r  -  yaw 
rate.  The  control  variables  are:  S„  •  left  elevator  angle,  •  right  elevator  angle,  6,,  -  left  aileron 
angle,  j,,  -  right  aileron  angle,  6r,  -  left  rudder  angle,  and  6r,  -  right  rudder  angle. 

The  eight-state  model  of  the  form  x  =  Fx  -I-  Bu  in  terms  of  the  dimensional  derivatives 
is  shown  in  Equation  (3.1).  The  values  assumed  by  the  dimensional  derivatives  depend  on  the 
equilibrium  flight  condition  about  which  the  model  is  linearised.  We  will  work  with  the  flight 
conditions  in  Table  1.1,  which  is  repeated  below  as  Table  3.1.  These  particular  conditions  are 
chosen  because  they  represent  the  aircraft  in  level  cruise,  the  condition  of  predominant  concern  for 
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(3.1) 


Note  that  the  input  matrix  of  Equation  (3.1)  has  left  and  right  inputs  for  each  type  of  control 
surface.  This  will  allow  us  to  apply  independent  dither  inputs  to  a  control  surface  on  one  side  of  the 
vehide  in  order  to  distinguish  its  effects  from  the  surface  on  the  other  side.  Cross  coupling  terms 
also  hdp  distinguish  right  from  left  devator  and  right  from  left  aileron.  These  terms  appear  in  the 
input  transfcmiation  matrix  of  Equation  (3.1)  as  the  Y',  L',  and  N'  terms  in  columns  1  and  2  for 


Table  3.1  Nominal  Flight  Conditions. 


Parameter 

Symbol 

Value 

Units 

IMm  Vdodty 

■gn 

169 

feet/second 

Weight 

200 

pounds 

Center  of  Gravity 

HM 

46.8 

inches 

Pitch  Angle 

■H 

0 

degrees 

Dynamic  Pressure 

30.43 

pounds /feet^ 

-4 
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the  elevator  and  as  X',  Z\  and  M'  terms  in  columns  3  and  4  for  the  ailerons.  No  cross  coupling 
into  the  longitudinal  channel  exists  for  the  rudders.  The  lack  of  such  terms  reasonably  represents 
the  behavior  of  the  real  LAMBDA  since  the  center  of  the  rudder  surfaces  lies  near  the  horisontal 
reference  line  drawn  from  the  aircraft  center  of  mass.  Therefore,  negligible  pitching  moments  due 
to  rudder  drag  are  induced  with  rudder  deflection. 


The  inputs  into  Equation  (3.1)  are  control  surface  angles.  The  control  surfaces  are  driven  by 
actuators  which  have  their  own  dynamic  characteristics.  The  transfer  functions  relating  actuator 
command  to  actuator  position  are  shown  in  Equations  (3.2),  (3.3),  and  (3.4)  [26]: 

Elevator  Actuator: 


j«(s)  136.20 

^..(<)  ~  +  21.628s  +  176.63 


(3.2) 


Aileron  Actuator: 

tf.(s)  _  216.84 

^-.(*)  ~  +  22.147s  +  224.42 

Rudder  Actuator: 

«,(s)  :i  9060 

~  «  + 4.4372 


(3.3) 


(3.4) 


See  Appendix  B  for  Bode  plots  of  aircraft  response  and  Subsection  3.3.2.1  for  Bode  plots  of  actuator 
responses.  The  real  control  surfaces  on  LAMBDA  are  limited  in  their  range  of  movement  according 
to  the  limits  in  Table  3.2. 


Table  3.2  Range  Limits  on  Control  Surface  Movement. 


Control  Surface 

Limits  [degrees] 

elevator 

±15“ 

aileron 

±15“ 

rudder 

±20“ 

In  addition  to  the  aircraft  equations  of  motion,  it  will  be  necessary  to  study  vertical  and 
lateral  j^-forces  experienced  by  a  would-be  pilot.  The  following  equations  are  implemented  in  the 
state  space  form  of  the  truth  model: 

Lateral  Acceleration: 

A,  =  Uq^  -  +  Uqt  +  l^T  -  l,p  (3.5) 
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Vertical  Acceleration: 


A,  =  VoOi  -  Uoq  + 1,4 


(J.6) 


Uo  is  the  trim  velocity  firom  l^tble  3.1.  The  values  for  I,  and  I,  represent  the  coordinate  position 
of  a  pilot  relative  to  the  center  of  gravity  of  the  aircraft.  Since  LAMBDA  has  no  pilot  on-board, 
I,  and  I,  were  chosen  to  correspond  to  the  location  of  the  on-board  accelerometer  [24:p.  2.9]  and 
have  the  values  given  by 


/,  =  0.3279/t 
1,  =  0.2903/t 


(3.7) 


Thus,  in  the  event  that  data  from  this  thesis  is  correlated  to  in-flight  tests,  no  coordinate  conversion 
would  be  necessary  to  compare  ^-forces. 


The  LAMBDA  has  eight  flight  data  sensors  which  correspond  to  the  eight  state  variables  of 
Equation  (3.1).  The  outputs  of  the  sensors  are  noisy  representations  of  the  state  variables.  The 
model  for  each  sensor  in  our  truth  model  is  simply  the  state  variable  plus  sero-mean  white  Gaussian 
noise  of  variance  (or  mean  squared  value)  Ri^i  which  is  the  corresponding  t-th  diagonal  element  of 
the  8-by-8  measurement  noise  covariance  matrix,  R: 


R  = 


R, 

0 

0 

0 

0 

0 

0 

0 


0 

Ra 

0 

0 

0 

0 

0 

0 


0 

0 

R, 

0 

0 

0 

0 

0 


0 

0 

0 

R0 

0 

0 

0 

0 


0 

0 

0 

0 

R0 

0 

0 

0 


0 

0 

0 

0 

0 

0 

0 


0 

0 

0 

0 

0 

0 

R* 

0 


0 

0 

0 

0 

0 

0 

0 

Rr 


(3.8) 


The  values  used  in  Equation  (3.8)  are  those  used  by  Capt  Hanlon  [3]  and  are  given  in  Table  3.3. 
They  are  the  result  of  analysis  of  in-flight  measurement  data. 
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l^ble  3.3  Sensor  Noise  Variances. 


Sensor 

Symbol 

Variance 

Units 

Forward  Velocity 

K 

1.6  X  10“* 

(feet/second')® 

Angle  of  Attack 

Ra 

1.16  X  10“* 

radians’ 

Pitch  Rate 

Rs 

1.194  X  10-’ 

(radians/second)’ 

Pitch  Angle 

Rs 

6.98  X  10-® 

radians’ 

Sideslip  Angle 

R0 

8.7264  X  10-* 

radians’ 

Roll  Rate 

Rr 

1.122  X  10"* 

(radians/second)® 

Roll  Angle 

R* 

1.45  X  10-* 

radians’ 

Yaw  Rate 

Rr 

9.801  X  10-* 

(radians/ second)’ 

S.2.2  Flif^t  Control  System  Design.  A  flight  control  system  (PCS)  based  on  a  Quantita¬ 
tive  Feedback  Theory  (QFT)  design  by  Capt  S.  Rasmussen  [26]  augments  the  flight  characteristics 
of  our  aircraft  truth  model.  The  FCS  enables  the  pilot  to  provide  pitch  rate  commands,  roll  rate 
commands,  and  sideslip  angle  commands.  In  order  to  command  left  and  right  control  surfaces, 
the  QFT  FCS  was  duplicated  in  left  and  right  channels  for  each  control  axis,  thereby  enabling 
independent  control  of  individual  surfaces.  This  configuration  is  realisable  since  the  controller  is 
implemented  in  the  form  of  difference  equations  in  the  on-board  computer  and  each  control  surface 
receives  its  commands  from  an  individual  output  port  of  the  computer.  The  controller  makes  use 
of  feedback  from  the  aircraft’s  pitch  rate,  roll  rate,  yaw  rate,  and  sideslip  angle  sensors,  which 
provide  noisy  measurements  of  the  corresponding  aircraft  states.  Our  truth  model  incorporates  the 
appropriate  noise  into  the  sensor  measurements.  Therefore,  the  QFT  FCS  will  receive  the  same 
noisy  measurements  that  are  fed  to  our  MMAE  algorithm.  Eventually,  it  would  be  desirable  to 
replace  the  noisy  measurements  with  MMAE-provided  estimates  of  these  aircraft  states. 

A  block  diagram  of  the  QFT  FCS  is  shown  in  Figure  3.1.  The  blocks  designated  by  Fll  J, 
F22j,  etc.,  are  the  prefilter  blocks  of  the  QFT  design.  Likewise,  the  GllJ,  G22j',  etc.,  blocks 
denote  feed-forward  compensators.  Difference  equations  based  on  a  sampling  period  of  T  =  0.02 
second  are  provided  to  implement  the  prefilters,  compensators,  and  washout  filter  (see  Appendix  C). 
It  is  important  to  note  that  the  specific  controller  design  used  in  this  thesis  failed  its  flight  test 
on  the  LAMBDA  in  August  1993.  Oscillations  were  induced  in  the  longitudinal  channel  due  to  a 
structural  bending  mode  which  resided  within  the  controller’s  response  envelope.  The  design  was 
successfully  corrected  but,  due  to  the  amount  of  work  that  would  have  to  be  re-accomplished,  the 
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Pilch  RmM 


Figure  3.1  QFT  Flight  Control  System  Augmenting  the  LAMBDA  Aircraft  Model. 


previous  design  is  used  consistently  throughout  this  thesis.  The  structural  modes  of  the  LAMBDA 
are  not  modeled;  therefore,  controller  performance  in  our  truth  model  should  not  be  unlike  the 
performance  of  the  corrected  controller. 

At  the  bottom  of  Figure  3.1,  the  reader  will  see  a  washout  filter  block  through  which  yaw  rate 
feedback  must  pass  before  being  summed  with  sideslip  angle  error.  The  function  of  this  high  pass 
filter  is  to  block  the  low  frequency  yaw  rates  commanded  by  the  pilot  in  his/her  effort  to  change 
the  sideslip  angle.  However,  high  frequency  disturbances  are  passed  and  subsequently  nulled  by 
the  controller.  In  Subsection  5.1,  the  impact  of  a  failed  yaw  rate  sensor  which  disables  the  washout 
filter  will  be  discussed. 


S.2.S  Dryden  Wind  Gnat  Model.  Our  purpose  in  this  thesis  is  to  show  that  the  MMAE 
algorithm  is  capable  of  performing  well  when  the  LAMBDA  is  in  atmospheric  fiight.  Wind  distur¬ 
bances  are  an  unavoidable  reality  in  this  environment,  so  we  would  like  to  simulate  wind  in  the 
computer  model.  The  choice  of  wind  gust  model  is  the  Dryden  wind  gust  model  for  two  reasons. 
First,  it  is  the  traditional  model  used  in  other  MMAE  theses  [3,  19,  21];  and  second,  it  is  one  of 
two  models  specified  by  MIL-STD<1797  [18] .  There  are  excellent  developments  of  the  Dryden  wind 
gust  model  in  Capt  Martin’s  thesis  [7]  and  Capt  Pogoda’s  thesis  [19].  The  essential  aspects  of  the 
Dryden  model  will  be  explained  here. 

Wind  disturbance  of  an  aircraft  is  a  random  process.  In  the  following  development,  inputs  of 
white  Gaussian  noise.  Equation  (3.9),  will  be  “shaped”  in  the  wind  gust  model  then  transformed 
into  disturbance  terms  to  be  added  to  the  state  equations  of  the  aircraft  state  space  model.  The 
input  white  noises  have  Gaussian  distribution  with  zero  mean  and  unit  strength.  This  is  represented 
by  the  continuous  time  Q  matrix  in  Ekjuation  (3.10),  where  E{w(t)w'^(t  +  r)}  =  Q(f{)j(r): 


(3.9) 
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10  0  0 

0  10  0 

Q  = 

0  0  10 
0  0  0  1 

The  ihapiiig  ia  accompliahed  by  pasaing  the  white  noiaea  through  filtera  having  random  proceaa 
outpnta  which  fit  the  power  apectral  denaitiea  of  the  Dryden  model  apedfied  by  MIL-STD-1797,  aa 
given  in  Equationa  (3.11)  through  (3.16).  ii  repreaenta  a  power  apectral  denaity  function.  Subacripta 
correapond  to  the  aircraft  atate  variable  aubjected  to  that  diaturbance,  e.g.,  ia  the  power 
apectral  denaity  of  wind  guat  diaturbance  aaaodated  with  forward  velocity  perturbationa.  Subacript 
g  denotea  a  wind  guat  model  power  apectral  denaity  rather  than  the  PSD  of  the  aircraft  atate  itaelf. 


(3.10) 


r  .  ,  V* 


(3.11) 


^a,(w)  V  /  V*  \* 

ir*V?  w* 

^  i«*» 

♦p,(«)  =  (i28,  0006^1*) 

«/».(«)  =  ^2LV  i  ^ 


(3.12) 

(3.13) 

(3.14) 

(3.15) 


+  “55^ 

Vt  ia  the  nominal  aircraft  velocity  and  6  ia  the  aircraft  wingapan.  The  variablea  £«  =  505.2, 
=  252.6,  and  £«  =  50  are  turbulence  acale  lengtha  in  feet/aecond  and  are  determined  from 
Figure  266  of  MIL-STD-1797  [18]  for  an  altitude  of  100  feet  above  the  ground,  =  O.ltiao  =  5.063 

where  U20  =  50.63  feet/aecond  ia  the  wind  apeed  meaaured  20  feet  above  the  ground  [18:p.653]. 
O’.  =  8.688  and  (r,  =  8.688  are  related  to  or.  =  5.063  aa  ahown  in  Figure  267  of  [18]. 
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The  tnnifer  fbactuni  oi  the  Aaping  filten  required  to  produce  ontpats  with  the  power 
■pectral  denaitiee  of  Eqnationa  (3.11)  throng  (3.16)  ere  given  respcetivdy  bj: 


(3.17) 


G  M  ^  *  +  ^ 


r  _ L 

*»'  ^  *>«(<)  46  a  +  * 


-G..(-) 


G  =  1 

*  w,(»)  •  U28, 0006^1*  y  7T^ 

4_ /.\  ^*\  or.  v- / 


«,(a) 


Gr,(-) 


yt(<)  _  -itVt 
»,(a)  36 


•  T  «n 


(3.18) 


(3.19) 


(3.20) 


(3.21) 


(3.22) 


The  transfer  fonctions  are  implemented  in  the  state  space  form  z  =  Fx  +  6w,  which  incorporates 
the  four  independent  white  noise  inputs  («;.,  w.,  w^,  and  w,)  and  eight  wind  gust  states  (w,,  a' , 
<*tt  9tt  Pgi  0ft  0gi  *ad  r, ).  The  subscript  g  denotes  that  these  are  perturbations  to  the  respective 
aircraft  states  due  to  wind  gusting.  The  prime  on  and  0'^  sinq>ly  means  that  these  are  internal 
states  to  the  second-order  a,  and  0f  processes,  respectively. 
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Finally,  a  traniformatiaa  matrix,  T^int  *•  given  in  Equation  (3.24),  adds  combinations  of  the 
unprimed  wind  states  to  the  aircraft  dynamic  states  as  shown  in  Equation  (3.25).  Note  that  the 
symbols  in  T^rni  share  the  identical  values  to  the  corresponding  symbols  in  Equation  (3.1). 

~xi  0  -x;  -x;  0  0  0  o 

-z;  0  -z;  -z;  0  0  0  o 

-m:  0  -m;  -if;  0  0  0  o 

000  0  000  0 

0  0  0  0  -y;  0  -r;  -y; 

0  0  0  0  0  -6^  -z; 

000  0  000  0 

0  0  0  0  -n;  0  -n; 

=  FXac/(  +  Bll  +  (3.25) 
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The  added  raaliim  a  wind  gnat  model  will  catiae  the  QFT  flight  control  syatem  (FCS)  to 
provide  actuator  commands  independent  of  pilot  inputs  in  an  attempt  to  reject  wind  disturbances. 
This  effect  may  be  an  aid  or  a  hindrance  as  we  search  tor  the  best  dither  input  to  command  in 
order  to  enhance  failure  identification.  Nevertheless,  wind  disturbance  is  a  reality  that  we  should 
not  neglect. 

S.S  MMAE  Design 

The  theory  behind  MMAE  was  established  in  Section  1.3.  In  the  present  section,  the  algorithm 
is  presented  which  is  implemented  in  FOBTRAN  co<fa.  Rather  thiMi  printing  all  of  the  FORTRAN 
source  code  with  aU  of  the  input  and  output  routines,  a  more  simplified  digestion  of  the  routines 
is  presented.  Only  those  statements  required  to  get  from  the  algorithm  inputs  of  command  inputs 
and  sensor  measurements  to  the  algorithm  outputs  of  failure  probability  and  fault  declaration  are 
presented. 

The  FORTRAN  code  for  this  thesis  is  identical  to  that  of  Capt  Hanlon’s  thesis  [3]  with  a  few 
modifications.  The  major  difference  is  that  Hanlon’s  code  is  designed  for  sin^e  failure  identification 
whereas  our  code  is  designed  for  single  and  dual  fault  detection.  Other  changes  include  a  re¬ 
formatting  of  the  input  and  output  files  so  that  MATLAB  [8]  instead  of  Matrix.  [4]  can  be  used  to 
prepare  the  input  files  and  process  the  output.  The  reason  for  converting  to  MATLAB  is  because  it 
is  more  widely  available  at  AFIT,  numerical  problems  have  been  detected  in  Matrix.,  and  because 
MATLAB ’s  graphics  capabilities  seem  to  be  more  flexible. 

3.3.1  Structure  of  MMAE.  The  FORTRAN  software  program  used  to  implement  the 
MMAE  algorithm  is  based  on  the  equations  presented  in  Section  1.3.  There  are  a  few  subtle  points 
concerning  the  algorithm’s  software  implementation  that  bear  discussion. 

The  MMAE  program  operates  on  a  sample  period  of  T,  =  0.02  seconds.  This  is  identical 
to  that  of  the  QFT  flight  control  system  on-board  the  LAMBDA.  The  impact  is  that,  for  each 
measurement  provided  at  T,  intervals,  the  MMAE  i»opagates  the  Kalman  filter  states  and  updates 
them  only  once.  Also,  a  probability-weighted  state  estimate,  Xjhuab,  »  updated  once  every  T, 
seconds  and  failure  status  inquiries  are  made  on  that  schedule  as  well. 
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biitid  pfobabilitiM  oa  llltan  «fc  dtCcmuMd  by  a  lower  limit,  putK,  vbicb  preveolt  any 
probataJitiee  from  gomg  to  lero: 

PtdtM  —  0.001  (3*^) 

V  aay  probabilitiee  were  to  go  to  sero,  tbe  recursive  nature  of  filter  probability  calculation  woold 
prohibit  subsequent  non-sero  probabilities.  Refer  to  Equation  (1.20).  The  initial  probability  on 
the  filter  holding  the  carreci  hypothesis,  Pmax,  i>  pre-calculated  according  to  the  total  number  of 
filters,  NF  —  15,  so  that  the  probability  sum  ci  all  elemental  filters  is  1.000. 


PttAX  =  (l.OOO  -  pittxiff  ~  1)1  =  0.986  (3.27) 

When  a  simulation  commences,  the  felly  functional  filter  assumes  the  maximum  probability  Pmax  = 
0.986.  Similarly,  when  a  new  filter  is  declared  to  have  the  correct  hypothesis  (and  that  new  bank 
of  filters  is  to  be  brought  on-line),  it  is  reassigned  the  probability  Pmax  immediately,  and  all  other 
filters  in  the  new  bank  are  initialised  with  probability 

The  rJ(<i)A~^(ti)rk(t<)  term  of  Equation  (1.22)  is  multiplied  by  -1  rather  than  the  Han¬ 
lon's  work  established  that  -1  produced  the  fastest  MMAE  probability  convergence  times  while 
minimising  false  alarms  [3:p.55].  Furthermore,  to  prevent  numerical  difficulties,  the  -rJP(ti)A~^(ti)rk(ti) 
is  limited  to  a  minimum  value  of  -50.  Also,  the  term  of  Subsection  1.3.3  has  been  stripped.  Su¬ 
perior  performance  (that  is,  removing  the  proneness  to  false  alarms  on  sensor  failures)  without  this 
leading  coefficient  has  been  established  [3, 19,  21]. 

A  probability  history  window  is  used  for  each  filter  to  average  the  past  ten  probabilities  result¬ 
ing  from  calculations  suggested  by  Equation  (1.20)  before  being  used  to  declare  that  a  particular 
elemental  filter  has  the  correct  failure  status  hypothesis,  t.e.,  that  its  averaged  probability  exceeds 
some  value,  here  selected  to  be  0.5.  Hanlon  noted  that  volatility  is  introduced  into  the  MMAE 
failure  declaration  process  with  shorter  window  sixes  [3].  Conversely,  longer  windows  3rield  sluggish 
performance.  With  a  probability  window  of  10  and  a  failure  declaration  trigger  of  0.5,  the  theo¬ 
retical  minimum  failure  identification  time  would  be  nT.  seconds  where  n  is  the  minimum  number 
of  sample  periods  between  actual  failure  and  MMAE  idoitification,  and  T,  =  0.02  second.  We  can 
solve  for  n  given  the  constraints  that  the  filter  hypothesising  the  failure  has  the  minimum  limit  on 
probability,  Pmin  =  0.001,  before  the  failure  and  the  maximum  probability,  Pmax  =  0.986,  after 
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tlie  failuie  u  calculated  by  Equation  (1.20). 


0.5  =  0.986n  +  0.001(10  -  n)10  (3.28) 

n  =  5.066  (3.29) 

£quati<HU  (3.28)  and  (3.29)  tell  ui  that  the  absolutely  Cutest  failure  identificatirai  time  with  our 
design  is  5  x  0.02  =  0.10  seconds,  under  the  constraints  listed  above. 

Tlu  minimum  window-averaged  probability  required  to  declare  a  failure  is  prjt/o  =  0.5.  The 
trigger  is  set  at  this  level  because  we  want  only  one  filter  to  be  declared  as  holding  the  correct 
h]rpothesis.  When  all  filter  probabilities  must  sum  to  1.0,  it  is  possible  for  only  one  filter  to  have  a 
probability  of  0.5  or  higher. 

The  items  discussed  above  are  steps  taken  to  translate  the  MhCAE  theory  presented  in  Chap¬ 
ter  I  into  a  practical  implementable  algorithm  which  has  the  structure  and  performance  charac¬ 
teristics  required  for  real  world  application.  The  program  code  used  in  testing  is  therefore  easily 
translatable  to  languages  other  than  FOBTBAN. 

S.S.2  Kalman  Filter  Design.  The  Kalman  filters  used  in  the  multiple  model  scheme  are 
organised  into  banks.  Each  bank  has  a  primary  filter  and  fourteen  secondary  filters.  These  cover 
all  failtires  possible  with  the  premise  that  the  primary  filter  refiects  the  current  failure  status  and 
that  any  possibility  of  one  additional  failure  will  be  covered  by  a  secondary  filter.  In  the  level-sero 
bank,  the  primary  filter  is  the  fully  functional  filter,  as  shown  in  Figure  1.2.  A  secondary  filter  of 
level-sero  becomes  a  primary  filter  once  the  MMAE  declares  the  corresponding  failure  and  moves 
to  a  level-one  bank.  Banks  in  level-one  also  include  a  fully-fimctional-aircraft  filter  to  provide  an 
escape  route  back  to  level-sero  in  the  case  of  a  false  failure  declaration. 

The  Kalman  filters  will  operate  in  the  steady-state-gain  condition.  That  is,  the  MMAE 
algorithm  will  use  pre-computed  constant  Kalman  filter  gain  matrices,  K^,  and  pre-computed 
constant  inverse  residual  covariance  matrices,  This  leaves  the  on-line  work  of  the  MMAE 

algorithm  limited  to  the  propagation  of  filter  states  and  residual  computation.  Discrete  time  state 
transition  matrices,  discrete  time  input  matrices,  and  output  matrices,  H^,  are  the  only 
additional  data  required  to  accomplish  this.  Therefore,  a  MATLAB  routine  was  devdoped  to 
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create  these  matrices  and  store  them  ahead  of  time  in  data  files  for  the  MMAE  algorithm  to  use 
later.  Similarly,  these  pre-computed  matrices  will  lessen  the  computatimud  load  when  the  MMAE 
algorithm  is  implemented  on  the  real  LAMBDA. 

The  truth  model  consists  of  the  aircraft  dynamics  modd,  the  wind  gust  model,  second-order 
actuator  models,  and  a  discrete-time  fiight  control  syston.  Since  the  fiight  control  system  (PCS) 
states  are  known  implicitly  at  any  time,  there  is  no  need  to  model  them  in  the  Kalman  filters. 
The  actuators  may  be  reduced  to  first-order  models  to  eliminate  computation  of  four  Kalman  filter 
states  (see  Equations  (3.2)  and  (3.3)).  The  wind  gust  states  are  reducible  to  scaled  additive  white 
noise  rather  than  shaped  noise.  The  resulting  Kalman  filter  model  is  left  to  represent  only  the 
aircraft  dynamics  model,  single-order  actuators,  and  uncertainty  due  to  wind  (without  explicit 
states  devoted  to  estimating  the  wind). 

To  accommodate  this  reduction  in  complexity  from  the  truth  model,  the  following  consid¬ 
eration  with  respect  to  inputs  must  be  made.  The  truth  model  will  have  command  inputs  which 
represent  the  deflections  applied  to  the  aircraft  control  stick.  These  command  inputs  are  processed 
by  the  PCS  and  end  up  as  the  actuator  comnumd  inputs  which  are  appUed  to  the  inputs  of  the  ac¬ 
tuators.  With  the  elimination  of  the  PCS  from  the  Kalman  filter  models,  the  inputs  to  the  Kalman 
filter  are  the  actuator  command  inputs  rather  than  the  command  inputs. 

3.3.2. 1  Actuator  Order  Reduction.  Equations  (3.2)  and  (3.3)  are  second-order  tram- 
fer  functions  representing  the  dynamics  of  the  actuators  on-board  the  LAMBDA.  In  the  interest 
of  saving  on-line  computational  time  for  our  MMAE  algorithm,  it  is  desirable  to  reduce  these 
transfer  functions  to  first-order,  thus  reducing  our  Kalman  filter  model  by  four  states.  A  study 
of  the  second-order  transfer  functions  of  Equations  (3.2)  and  (3.3)  by  referring  to  the  Bode  plots 
of  Pigures  3.2  and  3.3  shows  that  the  damping  ratio  is  very  high  and  that  we  can  expect  good 
approximations  from  first-order  transfer  functions. 

A  first-order  approximation  may  be  obtained  by  matching  its  bandwidth  and  steady  state 
gain  to  that  of  the  second-order  system.  The  bandwidth  is  obtained  by  choosing  the  frequency  at 
which  the  gain  crosses  the  half  power  point.  Por  the  elevator,  the  steady  state  gain  is 
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At  half  power,  the  gain  is  0.7711  x  ^  =  0.54S3.  To  find  the  bandwidth,  we  set  s  =  ju  and  take 
the  square  of  the  transfer  fimction  magnitude  by  squaring  the  real  and  imaginary  parts  and  setting 
this  equal  to  0.54S3*. 


136.2> 

(176.63  -  «»)»  +  (-i21.6280w)»  176.63* 


(3.31) 


Algebraic  manipulation  leaves  us  with  a  fourth  order  polynomial  in  u. 


u*  +  [(21.6280)*  -  2(176.63)1  +  (176.63)*  -  2(176.63)*  =  0  (3.32) 


which  has  roots  v  =  ±jl5.5863  and  w  =  ±11.3324.  We  desire  a  real,  positive  frequency  to 
represent  the  bandwidth,  so  we  are  left  with  an  elevator  bandwidth  of  BW,  =  11.3324  rad/sec. 
Similar  calculations  reveal  that  the  second-order  aileron  transfer  function  has  steady  state  gain, 
=  0.9662  and  BW^  =  14.3024  rad/sec.  First-order  transfer  functions  with  these  characteristics 
have  the  form 


K„  X  BW 
(s  +  BW) 


(3.33) 


Finally,  the  reduced-order  transfer  functions  for  the  elevator  and  aileron  actuators  used  in  the 
Kalman  filters  are  given  in  Equations  (3.34)  and  (3.35),  respectively.  The  frequency  responses  of 
these  transfer  functions  are  plotted  with  the  second-order  responses  in  Figures  3.2  and  3.3. 


«.(s)  8.7384 

^«.(«)  ~  («  +  11-3324) 

«.(s)  13.8193 

^».(«)  ~  (*  + 14.3024) 

Other  techniques  are  available  for  first-order  representation  of  second-order  systems.  However,  the 
technique  presented  above  does  a  good  job  of  matching  Bode  amplitude  ratio  plot  characteristics 
over  a  wider  band  of  frequencies  than  may  other  methods. 
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Figure  3.2  First-Order  (dashed)  and  Second-Order  (solid)  Elevator 
Actuator  Bode  Plots.  Half  Power  Magnitude  is  -5.3  dB. 
Bandwidth  is  11.3  rad/sec. 
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Frequency  (rad/secl 


Figure  3.3  First-Order  (dashed)  and  Second-Order  (solid)  Aileron 
Actuator  Bode  Plots.  Half  Power  Magnitude  is  -3.3  dB. 
Bandwidth  is  14.3  rad/sec. 
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S.S.t.2  Wind  Representation.  Tlie  wind  gut  model  of  Equaticm  (3.23)  hu  eight 
states,  six  of  which  are  added  in  some  proportion  to  the  aircraft  states  as  determined  by  of 
Equation  (3.24).  Again,  in  the  interest  of  saving  on-line  computational  time,  the  eight-state  wind 
gut  model  of  Equation  (3.23)  will  be  replaced  in  the  Kalman  filter  model  by  combinatiou  of  six 
scaled  white  Gausiam  noises  represented  by  Wfuttr  with  strengths  determined  by 


Q 


filter 


0  0  0  0  0 

0  0  0  0 

0  Qa,u  Qu  0  0  0 

0  0  0  Q,,  0  0 

0  0  0  0  Qp,  Qp,r, 

0  0  0  0  Qp,r,  Qr, 


(3.36) 


where  the  subscripts  correspond  to  the  subscripts  of  the  wind  states  in  Equation  (3.23).  The  off- 
diagonal  terms  represent  the  cross  correlation  indicated  in  the  spectral  deuities  of  Equations  (3.13) 
and  (3.16).  In  this  section,  we  will  show  how  the  elements  of  Q/<i(er  determined. 

Our  strategy  is  to  obtain  values  for  Qy^iter  which  have  the  same  average  power  spectral  deuity 
function  magnitude  as  the  wind  gust  power  spectral  deuities  across  an  appropriate  bandwidth.  The 
appropriate  bandwidth  is  that  of  the  corresponding  aircraft  state  variable.  Logarithmic  magnitude 
Bode  plots  of  the  LAMBDA’S  dynamic  responses  are  shown  in  Appendix  B.  The  bandwidth  for 
each  aircraft  state  variable  is  taken  &om  each  plot  by  subtracting  20  dB  from  the  peak  logarithmic 
magnitude  and  noting  the  highest  frequency  at  which  the  response  drops  below  this  line. 

The  next  step  is  to  integrate  the  power  spectral  deuities  from  Equatiou  (3.11)  through  (3.16) 
from  (i;  =  0  to  u;  =  Ubw  i  where  u/bw  >8  the  bandwidth  frequency  of  the  aircraft  state  that  corre¬ 
sponds  to  the  power  spectral  deuity  in  question.  The  result  of  the  integration  is  divided  by  the 
bandwidth  to  obtain  an  average.  The  average  is  then  placed  in  the  Q/jHer  matrix. 

Finally,  the  trauformation  matrix,  T^indt  is  used  to  add  the  coutant  strength  wind  compo¬ 
nents  into  the  aircraft  states.  So,  for  the  Kalman  filter  model.  Equation  (3.25)  becomes 


iaeft  —  Bu  T  mindW fitter 


(3.37) 
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i>  repreteated  by  G(r)  in  the  Kalman  filter  state  covariance  propagation  eqnatiosu,  (1.5) 
and  (1.11),  and  likewise,  is  represented  by  Q(r). 

The  above  procedures  will  produce  a  Kalman  filter  model  with  sero-order  wind  r^resentation 
and  a  good  Q  with  which  to  begin  the  tuning  process.  More  detail  on  these  procedures  is  found  in 
Martin  [7]. 

S..I  Teat  Rvna 

5.4.1  Monte  Carlo  Runs.  Due  to  the  large  amount  of  uncertainty  generated  by  tbe  wind 
gust  model,  there  will  be  a  variance  in  performance  from  simulation  to  simulation  even  though 
all  parameters  remain  the  same.  In  order  to  provide  representative  performance,  ten  Monte  Carlo 
nuis  will  be  averaged  for  each  set  of  test  conditions.  The  only  variable  to  change  will  be  the  seed 
that  starts  the  random  number  generator  which  produces  normally  distributed  values  for  the  truth 
model’s  four  inputs  to  the  wind  gust  model  and  additive  white  noises  for  the  sensor  measurements. 
The  number  ten  is  chosen  out  of  tradition  [3]  and  because  experience  with  the  MMA£  algorithm 
demonstrates  that  an  average  of  ten  runs  gives  a  very  good  prediction  of  what  happens  over  a  larger 
sample  of  runs. 

3.4.2  Input  Dithers.  The  input  dithers  will  be  applied  to  the  command  inputs  of  the  fiight 
control  system.  In  Figure  3.1  these  inputs  are  denoted:  left  pitch  rate  command,  right  pitch  rate 
command,  left  roll  rate  command,  right  roll  rate  command,  left  sideslip  angle  command,  and  right 
sideslip  angle  command.  Since  these  are  rate  and  angle  commands,  each  respective  control  surface 
will  not  necessarily  be  just  a  scalar  multiple  of  the  magnitude  or  phase  of  the  applied  command 
signal.  It  will  be  important  to  ensure  that  the  limits  of  control  surface  deflection  (see  Table  3.2)  are 
not  violated  as  the  characteristics  of  the  applied  dither  give  no  indication  of  the  travel  commanded 
to  the  surfaces. 

Primarily,  sinusoidal  signals  will  be  used  to  dither  the  aircraft.  Magnitude,  frequency,  and 
phase  will  be  variable  parameters.  We  are  particularly  interested  in  the  effects  of  various  dither 
frequencies  on  failure  identification  times.  The  magnitude  of  dither  command  also  affects  failure 
identification  times  but  this  effect  is  more  predictable.  In  general,  larger  magnitude  dithers  shorten 
identification  time.  This  is  known  from  using  the  MMAE  program  in  practice  nms  and  from 
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prior  research  [3:p.36].  The  phase  relationship  between  left  and  right  dithers  disambiguates  the 
identification  of  left  from  ri^t  fi^ed  actuators  [3:p.37].  A  phase  relationship  between  left  and 
right  dithers  will  be  established  by  informal  experiment  to  determine  if  left  failed  actuators  are 
continually  and  easily  distinguished  from  right  failed  actuators.  Once  the  value  for  phasing  is 
established,  it  will  not  be  altered  throughout  our  formal  experiments. 

The  input  dither  will  be  used  to  control  the  magnitude  of  p-forces  applied  to  the  aircraft. 
Limits  on  p-force  magnitude  are  established  at  ±0.10  g  for  vertical  acceleration  and  0.20  g  for  the 
horixontal  acceleration.  These  limits  are  suggested  by  Menke  [15:p.50]  as  a  result  of  his  "intuitive 
reasoning  and  previous  hAtiHling  qualities  experience.”  Athans  and  his  co-authors  used  a  maximfim 
limit  of  0.25  ^  in  the  lateral  direction  to  define  their  quadratic  performance  criterion  in  the  design 
of  their  Linear  Quadratic  Gaussian  (LQG)  compensator  for  the  F-8C  aircraft  [l:p.771].  Their  hori¬ 
zontal  limit  was  established  with  the  understanding  that  any  horizontal  acceleration  experienced  in 
maneuvering  is  undesirable  and  that  this  limit  is  used  as  an  LQG  weighting  factor.  Furthermore, 
discussions  with  researchers  at  Armstrong  Laboratories  Combined  Stress  Branch  reveal  that  "sub- 
liminal”  acceleration  is  indeed  an  extremely  subjective  quantity.  The  human  is  able  to  perceive 
extremely  low  levels  of  angular  acceleration  and  linear  acceleration  on  the  order  of  He  or 

she  is  able  to  endure  several  jf’s,  but,  the  acceleration  range  to  be  described  as  "not  annoying”  or 
"not  noticeable”  is  not  in  the  realm  of  research  conducted  by  the  Combined  Stress  Branch. 

Information  from  Dr.  R.  £.  Van  Patten,  Ph.D.,  P.E.,  retired  from  Armstrong  Laborato¬ 
ries,  points  out  that  the  human  body  is  able  to  detect  angular  acceleration  rates  of  0.1  to  0.5 
degrees/second/second.  Vibration  perception  of  the  body  is  complex  ud  differs  from  part  to  part. 
In  the  frequency  band  of  1-10  Hz,  the  hand  is  able  to  sense  accelerations  as  small  as  0.010  g.  The 
visceral  cavity  has  a  natural  frequency  of  about  4.5  Hz,  so  dither  frequencies  of  around  u  =  26 
rad/sec  should  be  avoided. 

A  book  by  Schaefer  which  compiles  the  results  of  many  studies  on  the  stress  of  vibrations  and 
p-loading  on  human  physiology  provides  insight  into  the  subjectivity  of  "subliminal”  [20:pp.55,57]. 
In  Figure  15  of  Schaefer’s  book,  p-forces  are  plotted  against  frequency  for  several  curves.  The 
perception  curve  corresponds  to  the  lowest  y-forces  perceivable  by  human  test  subjects.  Voluntary 
tolerance  describes  the  level  of  p-forces  which  unprotected  test  subjects  refuse  to  tolerate  for  ex- 
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poaure  durationa  of  over  5  to  20  minutea.  Thia  frequency  curve  peaka  at  about  3  p’a  at  the  4  Hi 
frequency.  Teat  aubjecta  report  unpleasantness  for  p-forcea  of  0.08  g  at  about  2  Hi  and  even  leaa 
acceleration  for  other  frequenciea  between  1  and  10  Hi.  However,  Schaefer  pointa  out  that  pilota  of 
military  aircraft  endure  vibrationa  with  p-forcea  leaa  that  0.08  p  for  long  duradiona  of  up  to  eight 
houra  "without  obaervable  detrimental  effect!  on  performance  or  health”  [20:p.57].  Thia  reaearch 
doea  not  define  but  aupporta  our  deciaion  to  limit  vertical  p-forcea  impoaed  by  our  dither  routine 
to  0.10  p. 

Finally,  a  March  1993  interview  [5]  with  an  Air  Force  pilot,  Capt  Jim  Wicker,  a  C-141  pilot 
of  the  3950th  Teat  Wing,  reveals  that  "aubliminal”  acceleration  might  have  the  quality  of  un¬ 
predictability.  Pilots  routinely  endure  acceleration  due  to  wind  turbulence  without  annoyance  or 
degradation  of  duty  performance.  Though  gusts  may  be  noticeable  at  times,  they  cannot  be  antic¬ 
ipated  and  this  quality  may  allow  higher  p-levels  to  be  tolerated  than  if  a  constant  and  predictable 
sinusoidal  application  of  p-forces  were  applied. 

3.4’S  Single  Failure  Verification.  Tuning  the  elemental  Kalman  filters  and  verifying  single 
failure  performance  go  hand-in-hand.  Tuning  will  only  involve  changes  to  Q  (since  R  is  assumed 
to  be  well  known)  and  verified  by  achieving  consistent  MMAE  performance  in  identifying  single 
failures.  Criteria  for  successful  single  failure  performance  are:  no  false  alarms  in  any  of  ten  12- 
second  Monte  Carlo  runs  for  each  of  fifteen  failure  configurations;  no  missed  alarms  over  the  same 
test  range;  and  identification  of  the  correct  failure  in  TniniiniiTn  time,  not  to  exceed  8  seconds. 
Furthermore,  experimentation  to  find  the  optimal  dither  routine  will  produce  improved  MMAE 
performance  in  identifying  single  fail'.  ; 's. 

3.4.4  Dual  Failure  Performance  Evaluation.  Using  the  optimal  dither  technique  developed 
by  our  research,  the  performance  of  the  MMAE  algorithm  will  be  tested  against  dual  failures.  All 
possible  combinations  of  two  failures  will  be  tested.  The  first  failure  induced  will  precede  the  second 
failure  by  one  second.  This  time  lapse  should  allow  the  MMAE  to  identify  the  first  failure  and 
stabilise  its  probabilities  before  being  subjected  to  a  second  failure. 

The  most  important  criterion  for  successful  performance  is  that  a  majority  of  MMAE  prob¬ 
ability  must  lie  with  the  filter  holding  the  hypothesis  of  both  induced  failures.  In  situations  where 
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1^3.4  MMAE  Kafaxun  Piker  Codes. 


Code 

Filter  Model  Hqtresents: 

FF 

fully  functional  aircraft 

A1 

right  elevator  actuator  failure 

A2 

left  elevator  actuator  failure 

A3 

ri^t  aileron  actuator  failure 

A4 

left  aileron  actuator  failure 

AS 

right  rudder  actuator  failure 

A6 

left  rudder  actuator  failure 

SI 

forward  vdodty  sensor  failure 

S2 

angle  of  attack  sensor  failure 

S3 

pitch  rate  sensor  failure 

S4 

pitch  angle  sensor  failure 

S5 

sideslip  angle  sensor  failure 

S6 

roll  rate  sensor  failure 

S7 

roll  angle  sensor  failure 

S8 

yaw  rate  sensor  failure 

the  MMAE  does  not  identify  the  first  failure  before  the  second  failure  is  induced,  the  MliCAE  is 
forced  to  choose  a  filter  hypothesising  only  one  failure  in  the  face  of  two  failures.  The  second  failure 
induced  may  be  the  first  identified  and  subsequently,  the  first  induced  failure  may  be  identified  by 
the  MMAE’s  selection  of  a  level*l  filter  that  hypothesises  both  failures.  The  order  of  identification 
is  not  so  important  as  the  fact  that  both  failures  have  indeed  been  identified.  Nevertheless,  order 
of  identification  not  matching  the  order  of  failure  onset  will  be  noted  in  the  analysis. 


S.4’5  Outpvt  Format.  MMAE  performance  will  be  represented  by  time  histories  of  the 
elemental  Kalman  filter  probabilities.  The  probability  traces  of  the  fifteen  Kalman  filters  run 
simultaneously  during  an  MMAE  simulation  and  the  results  of  ten  Monte  Carlo  runs  must  be 
presented  in  a  convenient  and  easy-to-understand  format.  Such  a  one-page  compilation  of  data 
is  shown  in  Figure  3.4.  Codes  enumerated  in  Table  3.4  are  used  to  denote  the  hypothesis  held 
by  each  filter.  Note  that  the  time  axes  runs  from  2  to  12  seconds.  The  first  two  seccmds  of 
simulation  are  eliminated  to  allow  transients  to  settle  out.  Failures  are  introduced  four  seconds 
into  the  simulation.  Shown  in  Figure  3.4  is  the  MMAE  perfonnance  against  a  right  devator  actuator 
failure.  The  probability  at  each  sample  time  is  the  average  probability  of  one  filter  from  ten  Monte 
arlo  runs.  The  time  listed  next  to  the  vertical  line  inside  the  plot  for  A1  is  the  average  time 
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tliat  tbe  MMAE  took  to  identify  the  A1  filter  ai  having  the  correct  hypotheiis.  At  tlii«  time, 
the  MMAE  switches  to  the  filter  bank  bedding  the  right  elevator  actuator  failure  as  the  primary 
hypothesis.  The  probabilities  for  this  new  bank  of  filters  are  plotted  to  the  right  of  the  vertical 
dash-dot  lines  in  filters  A2  through  S8.  The  double  codes  on  the  left  of  these  vertical  lines  denote 
the  dual  failure  hypothesis  held  by  the  new  filters  just  brought  on-line.  Becall  that  fully  functional 
and  Al  h3rpotheses  are  also  in  the  new  bank,  so  the  first  two  plots  in  the  left  column  are  meaningful 
from  the  time  the  new  bank  is  brought  on  to  the  12  second  point. 

Another  presentation  format  to  be  used  is  the  compilation  of  a  series  of  all  possible  failures 
induced  against  the  MMAE  algorithm.  See  Figure  4.15.  In  this  case,  only  the  filtm  with  the 
hypothesised  failures  are  shown.  Since  fourteen  different  failures  are  induced  in  fifteen  different 
ten-run  simulations  (including  the  fully  functional  condition),  fifteen  probability  traces  are  shown 
as  in  the  single  simulation  case.  However,  here  it  is  important  to  remember  that  each  trace  is  from 
a  simulation  with  different  failure  condition  than  the  others. 

Each  Monte  Carlo  run  will  have  its  own  characteristics  in  terms  of  time  to  identify  the  failure 
and  false  and  missed  alarms.  The  formats  given  here  only  represent  the  mean  probability  time 
histories  and  not  the  mean  ±  l<r  performance  boundaries  because  the  we  are  interested  in  MMAE 
failure  identification  decision  times.  Knowing  the  mean  ±  la  statistical  boundaries  will  provide 
little  information  that  is  of  use  to  us  in  a  pictorial  representation  that  already  makes  a  big  reduction 
of  the  experimental  results. 

3.5  Chapter  Summary 

A  thorough  explanation  of  the  tools  and  techniques  to  be  used  in  our  experiments  has  been 
given  in  this  chapter.  Although  a  detailed  code  listing  of  the  MATLAB  and  FORTRAN  programs 
developed  for  this  thesis  is  not  provided  in  this  text,  the  reader  should  have  an  idea  of  their  structure 
and  function  when  he/ she  considers  the  detailed  presentation  of  the  LAMBDA  model,  specifics  of 
the  MMAE  design,  and  the  desired  format  of  the  test  results  given  in  this  chapter.  The  Results 
and  Analysis  to  follow  are  based  on  the  foundations  built  here. 
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IV.  ResuHs  and  Primary  Analyses 


This  clu^>ter  presents  the  data  resulting  from  the  performance  of  tasks  described  in  Ch^ 
ter  m.  First,  the  process  of  tuning  the  Kalman  filters  for  the  MMAE  filter  banks  is  discussed.  A 
new  technique  for  tuning  is  compared  to  the  analytic  method  described  in  the  Kalman  filter  design 
section  of  the  previous  chapter.  Secondly,  the  specifics  of  a  plan  to  find  the  optimal  dither  are 
presented.  The  results  of  executing  this  plan  are  discussed  in  detail,  along  with  an  analysis  that 
leads  to  the  conclusion  of  an  optimal  dither  routine.  MMAE  performance  while  using  real  pilot 
stick  commands  for  aircraft  stimulation  are  evaluated  as  an  alternate  form  of  dither.  Finally,  the 
MMAE  performance  against  dual  failures  is  evaluated. 


4.1  Tuning  the  Kalman  Filters 


Since  the  wind  gust  model  is  reduced  to  additive  white  Gaussian  noise  in  the  Kalman  filter 
models  as  described  in  Subsection  3.3.2,2,  a  relatively  poor  tracking  of  wind  dynamics  is  expected 
from  the  Kalman  filters.  The  power  spectral  density  analysis  procedure  of  Subsection  3.3.2.2 
provided  a  starting  shown  in  Equation  (4.1): 
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(4.1) 


Informal  experimentation  showed  that  this  analytic  estimate  of  Q must  be  a4justed  to  minimise 
false  alarm  declarations  by  the  MMAE.  However,  the  adjustment  must  be  made  with  the  following 
in  mind.  Tight  timing  in  the  face  of  unmodeled  dynamics  will  enhance  random  filter  probability 
shifts  while  loose  tuning  causes  sluggish  MMAE  performance  and  even  missed  identifications. 

The  difficulty  in  tuning  the  particular  design  of  filter  model  represented  by  Equation  (3.37) 
is  that  each  element  of  Q/j|t«r  Ekjuation  (3.36)  is  not  transformed  by  T^ind  of  Equation  (3.25) 

to  affect  only  one  aircraft  state  variable.  Rather,  a  change  in  for  instance,  will  affect  the 
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covariance  of  all  longitudmal  aircraft  state  estimates  simultaneously.  The  same  is  true  for  Qa, 
and  Q,,.  Similarly,  the  lateral  elements  of  each  have  an  effect  on  all  of  the  lateral  states. 

Moreover,  the  impact  of  may  not  have  the  majority  of  influence  over  the  addition  of  white 
noise  to  the  aircraft  state  indicated  by  its  subscript,  u,  forward  velocity  perturbation.  The  white 
noise  added  to  form  u  is  dictated  by  the  constants  Ci  through  C4  in  Equation  (4.2): 

u  =  X^u  +  X^a  +  X^q  +  X^fi  +  Ciw^^  +  (^*2) 

The  numerical  values  of  Ci  through  C4  are  determined  by  the  multiplicaticm  of  T^i.^  x  Q .  Even 
if  these  constants  were  easily  obtained,  it  is  no  trivial  exercise  to  affjust  the  individual  Q'%  so  that 
the  residuals  for  each  of  the  four  longitudinal  aircraft  state  variables  have  the  desired  covariance. 

To  save  time  in  timing  and  to  assure  that  the  tuned  filter  is  not  prone  to  false  alarms  yet 
able  to  respond  quickly,  a  tuning  algorithm  is  impl^ented  in  MATLAB.  The  strategy  is  to  use 
various  values  for  Q/uien  the  Kalman  filters  for  the  level-0  bank  (see  Figure  1.2),  then  run 
MMAE  simulations  against  fuUy-functional-aircraft  truth  data.  The  diagonal  elements  of  Q/ater 
are  incrementally  reduced  one  after  the  other  until  five  Monte  Carlo  simulations  are  run  without 
the  MMAE  probability  of  the  fully  functional  filter  dropping  below  2%  of  its  maximum  value, 
=  0.9860,  to  pff  =  0.9663.  The  algorithm  proceeds  as  follows:  a  is  chosen,  MMAE 

simulations  are  run  until  ppp  <  0.9663.  If  all  five  Monte  Carlo  runs  result  in  ppp  >  0.9663  for  all 
time  samples,  then  Q/jit«r  i*  decremented  again  until  a  ppp  is  detected  below  the  limit. 

The  strategy  for  decrementing  Qfnt„  is  to  decrement  by  one  increment,  run  one  MMAE 
simulation  of  five  Monte  Carlo  runs,  then  decrement  Qa^  by  one  increment,  run  one  MMAE  simu¬ 
lation  of  five  Monte  Carlo  runs,  etc.,  so  that  the  dii^onal  elements  are  reduced  in  a  level  manner. 
Intuitively,  this  level  reduction  approach  makes  sense,  because  of  the  relatively  equivalent  effects  im¬ 
posed  by  each  element  of  Q/jK,,  on  the  filter’s  state  estimates.  Cross  correlation  terms  maintained 
a  cross  correlation  coefficient  of  0.91  so  that  =  0.91y^Qa, and  Qp^r,  =  ^-^^y/Qp^y/Qr,- 
The  cross  correlation  coefficient  had  to  be  set  manually  for  two  reasons.  needs  to  have 

positive  eigenvalues.  Also,  too  much  correlation  makes  the  MMAE  algorithm  prone  to  false  alarms 
and  too  little  makes  it  sluggish.  A  balance  was  struck  in  informal  experiment  to  arrive  at  the  value 
of  0.91. 


4-2 


The  final  Qf^ttr  resulting  firom  this  algarithm  is  shown  below.  Note  the  severe  reductiim  in 
Qug,  the  (1,1)  element.  A  possible  explanation  for  this  is  that  the  five  Monte  Carlo  runs  added  up 
to  a  total  of  60.10  seconds,  a  short  time  compared  to  the  magnitude  of  the  time  constant  found  in 
the  power  spectral  density  of  of  Equation  (3.11).  The  differences  between  Equaticm  (4.1) 

and  Equation  (4.3)  give  some  indication  of  the  validity  of  the  noise  model  reduction  procedure 
presented  in  Subsection  3.3.2.2. 

3.09  0  0  0  0  0 

0  2.10  X  10"*  8.28  X  10"*  0  0  0 

0  8.28  X  10"“  3.94  x  10"^  0  0  0 

0  0  0  1.06  X  10-*  0  0 

0  0  0  0  9.79xl0-<  1.33x10-“ 

0  0  0  0  1.33  X  10-“  2.18  x  10-“ 

The  of  Equation  (4.1)  was  derived  from  power  spectral  density  analysis.  The  Q/utt  of 

Equation  (4.3)  was  derived  from  MMAE  algorithm  performance  analysis. 

The  MMAE  algorithm  performs  its  Kalman  filter  propagations  and  updates  in  the  discrete¬ 
time  equations  of  (1.10)  and  (1.15).  Maximum  use  of  on-line  processing  time  is  gained  by  pre- 
computing  the  constant  steady  state  Kalman  filter  gain  of  Equation  (1>14).  Steady  state  Kalman 
filter  gains  and  residual  covariance  matrices  for  each  elemental  filter  are  pre-computed  in  MATLAB 
[8]  using  the  function  dlqe  (discrete  linear  quadratic  estimator).  Inputs  to  dlqe  are:  f  discretixed 
with  a  sample  period  of  T,  =  0.02  second;  G^,  an  identity  matrix  (see  Equation  (1.13));  H  of 
Equation  (1.2);  R  from  Equation  (1.4);  and  a  second  order  approximation  of  from  Equation  (1.5) 
as  shown  below  in  Equation  (4.4). 

Qj  «  (♦GQG'^*'^  -I-  GQG*^)  X  ^  (4.4) 

A 

The  steady-state  state  estimation  covariance  matrix  resulting  from  dlqe,  P',  is  used  to  calculate 
Afc  as  in  Equation  (1.24).  At  is  inverted  and  the  result  is  stored  in  the  filter  data  file  along  with 
K  (produced  directly  by  dlqe),  #(t,-,  t,>i),  H,  and  B,i  for  real-time  use  by  the  MMAE  algorithm. 
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4‘i  Inveatigt^ion  of  DHher$ 


The  objective  of  finding  an  optimal  dither  it  accomplished  in  this  section.  The  strategy  is 
to  determine  each  failure  condition’s  sensitivity  to  the  frequency  of  the  dither,  and  then  to  do 
an  analysis  to  pick  a  promising  frequency,  and  finally  to  adjust  the  magnitude  to  improve  failure 
identification  time  frirther. 

The  dithers  used  are  sinusoidal.  Each  control  surface  is  controlled  by  a  command  input 
dither  which  has  the  form  i4sin(ii;t  +  4)  where  A,  w,  and  ^  are  held  constant  throughout  each 
simulation.  The  phase  angle,  is  held  constant  for  all  simulations.  The  effects  of  varying  ^  are 
not  presented  in  a  formal  study.  However,  Hanlon  [3]  stated  that  a  phase  difference  between  similar 
control  surfaces  is  essential  for  MMAE  to  distinguish  ri^t  from  left  failures  [3].  The  ^  used  here 
is  a  15**  offset  between  right  and  left  sides  for  all  three  sets  of  control  surfaces.  In  addition,  the 
effects  of  control  surfaces  on  dynamic  movement  of  the  aircraft  may  be  reduced  by  phasing  right 
surface  movement  180°  out  of  cycle  from  the  left  surface.  In  selecting  a  phase  offset,  the  desired 
effect  is  a  balance  of  aircraft  state  excitation  and  control  surface  movement.  With  no  phase  offset, 
little  surface  movements  cause  moderate  changes  in  aircraft  states.  With  considerable  phase  offset, 
the  control  surfaces  end  up  moving  quite  a  bit  because  they  are  fighting  each  other  in  the  flight 
control  system’s  attempt  to  reach  the  level  of  aircraft  state  excitation  required  by  the  left  and  right 
command  inputs.  This  effect  is  presented  in  detail  on  page  4-35  when  elevator  actuator  failures  are 
discussed.  A  balance  of  aircraft  state  excitation  and  control  surface  movement  is  achieved  by  using 
the  following  phase  relationships  determined  in  preliminary  experimentation. 


4>er  =  0° 
</>e,  =  195° 
K  =  30° 
=  225° 

<f>rr  =  60° 

=  255° 


(4.5) 
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Variatiana  in  phase  would  add  another  dimension  to  our  research.  So,  in  the  interest  of  time  savings, 
the  relationships  of  Equation  (4.5)  are  held  constant  throughout  all  testing  done  to  develop  the 
optimal  dither. 

Increasing  dither  magnitude  has  the  effect  of  decreasing  failure  identification  time  for  all  types 
of  failures,  with  few  exceptions  (roll  rate  sensor  and  roll  an|^  sensor).  This  is  known  both  intu¬ 
itively  and  by  exercising  the  MMAE  system.  This  inverse  relationship  will  be  used  after  a4jasting 
frequency  simply  because  magnitude  adjustment  has  a  known  effect.  The  dither  magnitudes  are 
varied  in  discrete  intervals  across  a  range.  Thus,  our  dither  magnitude  space  is  discretised  to  these 
values:  2, 3, 4, 5, 6, 7,  and  8.  No  finer  discretisation  will  be  used  due  to  length  of  time  it  takes  to  run 
each  simulation.  The  frequency  study  is  accomplished  with  a  base  magnitude  of  6  degrees/ second 
for  both  the  pitch  rate  and  roll  rate  command  inputs,  and  the  sideslip  angle  command  base  mag¬ 
nitude  will  be  6  degrees  for  the  rudder  input  commands.  These  magnitudes  have  the  quality  of 
providing  great  enough  state  excitation  to  allow  the  MMAE  to  consistently  identify  failures  over 
the  band  of  test  frequencies. 

The  the  effects  of  varying  the  frequency  component,  u>,  are  studied  first.  There  are  base 
frequencies  which  are  multiplied  by  a  frequency  factor  to  get  the  range  of  test  frequencies  in  a 
discretised  space.  The  factors  are:  1/16, 1/8, 1/4, 1/2, 1, 1.9, 2,  2.5, 3,  and  4.  The  base  frequencies 
are  6.6611  rad/sec  for  the  elevators  (near  the  short  period  natural  frequency)  and  3.6193  rad/sec 
for  the  ailerons  and  rudders  (near  the  Dutch  roll  natural  frequency).  However,  the  selection  of  the 
base  frequencies  should  be  considered  somewhat  arbitrary,  as  they  will  be  multiplied  by  the  stated 
factors  to  arrive  at  various  test  frequencies. 

The  presentation  of  data  is  in  table  and  companion  figure  format.  Table  4.1  and  Figure  4.1 
will  be  used  in  the  following  explanation.  Remember  that  dither  frequency  is  the  test  variable.  We 
are  looking  for  its  effects  on  “Failure  ID  Time”  and  “Vertical  Acceleration”  as  labeled  in  the  left¬ 
most  coltunn  of  Table  4.1.  THal  numbers  at  the  top  of  each  column  are  numbered  with  ascending 
dither  frequency,  not  necessarily  in  the  order  that  they  were  performed,  for  the  ease  of  the  reader. 
An  exhaustive  array  of  statistics  for  vertical  p-forces  is  given  for  each  trial,  so  that  a  rough  but 
accurate  distribution  curve  may  be  visualised  to  gain  a  feel  for  the  acceleration  environment  on 
board  the  aircraft.  The  top  plot  of  Figure  4.1  gives  a  graphical  representation  of  this  statistical 
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diatribution.  The  ±2<r  wiatitt;ic8  are  what  will  be  compared  against  the  p-limits  in  both  the  votical 
and  hoiisontal  directions.  Now,  refer  to  the  bottom  plot  of  Figure  4.1.  Here,  only  the  ±2a  statistics 
are  plotted  against  vertical  acceleration  and  failure  identification  time.  Each  trial  is  represented 
by  an  X.  The  connecting  lines  are  straight  from  point  to  point  (no  best-fit  lines).  For  clarity,  trial 
numbers  are  not  placed  next  to  the  X’s  although  they  could  easily  be  correlated  to  trial  numbers 
by  matching  "Failure  ID  Time”  from  Table  4.1  to  the  "Time  to  identify  failure”  on  the  abscissa  of 
Figure  4.1. 

An  interesting  feature  of  these  plots  is  that,  for  higher  frequencies,  the  ±2(r  bounds  are  fairly 
linear  and  symmetric  about  the  acceleration  =  0  g  line.  As  the  frequencies  go  lower,  the  failure 
identification  times  hit  a  "brick  wall”  and  the  accelerations  are  no  longer  symmetric  but  tend  to  drift 
in  one  direction  together.  This  is  due  to  the  short  time  of  simulation  as  compared  to  the  time  period 
of  the  low  frequency  dither  cycle.  Since  the  dither  cycle  was  not  completely  finished  by  the  end  of 
the  simulation,  the  acceleration  samples  cannot  be  evenly  distributed  about  a  mean  of  zero.  If  the 
tests  are  re-run,  the  simulation  duration  should  last  for  an  integer  number  of  dither  cycles  so  that 
an  even  distribution  of  acceleration  statistics  may  be  obtained.  However,  these  lower  frequencies 
will  have  other  reasons  for  being  undesirable  candidate  for  the  optimal  dither.  Generally,  the  low 
frequency  dithers  caused  high  p-loading  as  compared  to  dithers  of  higher  frequency  and  identical 
magnitude.  This  is  because  the  aircraft’s  Bode  responses  have  a  much  higher  gain  at  the  low 
phugoid  frequency  =  0.2484  rad/sec)  and  low  spiral  divergence  frequency  (u;,^raJ  =  0-0231 
rad/sec).  See  Appendix  B.  Even  though  the  lowest  frequency  tested  in  our  research  is  hi^er  than 
those  of  the  phugoid  and  spiral  modes,  the  trend  toward  higher  gain  with  lower  frequency  does 
have  its  effects  in  our  results. 

The  next  25  pages  contain  the  companion  plots  and  tables  for,  first  the  longitudinal  channd 
actuators  and  sensors,  and  then  the  lateral  channel  actuators  and  sensors.  The  order  of  presentation 
is  different  from  that  of  Table  3.4  because  it  is  more  convenient  to  group  the  actuators  with  the 
sensors  they  infiuence  for  purposes  of  analysis.  The  reader  is  encouraged  to  browse  through  these 
pages  at  leisure  before  a  detailed  analysis  of  these  results  is  presented  beginning  on  page  4-35. 
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Right  Elevator  Actuator  Failure 


-f/- 2  sigma  bourKfs 


Figure  4.1  ^-forces  vs  ID  time  for  Bight  Elevator  Actuator  failure  as  frequency  changes. 
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Vertical  Acceleration,  [g's]  Vertical  Acceleration,  [g's] 


Left  Elevator  Actuator  Failure 


+/•  2  sigma  bounds 
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Figure  4.2  jf-forces  vs  ID  time  for  Left  Elevator  Actuator  failure  as  frequency  changes. 
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Vertical  Acceleration,  [g's] 
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Figure  4.3  v$  ID  time  for  Forward  Veiodty  Sensor  failure  as  frequency  dianges. 
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Vertical  Acceleration,  {g's]  Vertical  Acceleration,  {g'a] 


Angie  of  Attack  Sensor  Failure 


2  sigma  bounds 


Figure  4.4  g-foices  vs  ID  time  for  Angle  of  Attack  Sensor  failure  as  frequency  dianges. 
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Pitch  Rata  Sernor  Failure 


*!•  2  sigma  bounds 


Figure  4.5  ^-forces  va  ID  time  for  Pitch  Rate  Sensor  failure  as  frequency  changes. 
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w- 2  sigma  bounds 


Time  to  identify  failure,  [sec] 


Figure  4.6  g-forces  vs  ID  time  for  Pitch  Angie  Sensor  failure  as  frequency  changes. 
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Vertical  Acceleration,  [g's] 
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Figure  4.7  j^-forces  vs  ID  time  for  Right  Aileron  Actuator  failure  as  frequency  changes. 
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Figure  4.8  ^-forces  vs  ID  time  for  Left  Aileron  Actuator  failure  as  frequency  changes. 
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Vertical  Acceleration,  [g's] 


Right  Rudder  Actuator  Failure 


+/-2sigmatioun(te 


Figure  4.9  ^-forces  vs  W  time  for  Bight  Rudder  Actuator  failure  as  frequency  changes. 
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Vertical  Acceleration,  [g's]  Lateral 
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Figure  4.10  g-forces  va  ID  time  for  Left  Rudder  Actuator  failure  as  frequency  changes. 
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Vertical  Acceleration,  [g’s]  Lateral  Acceleration,  [g’e] 


Sideslip  Angle  Sensor  Failure 


2  sigma  bounds 


Figure  4.11  jr-forces  vs  ID  time  for  Sideslip  Angle  Sensor  failure  as  frequency  changes. 
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Figure  4.12  g-forcea  vs  W  time  for  Roll  Rate  Sensor  failure  as  frequency  changes. 
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4.t.i  Analysu  of  MMAE  Performance  Agahui  Varying  Dither  Preqaency.  The  dmta 
presented  in  the  previous  pages  is  now  analysed  with  the  purpose  of  determinixig  the  optimal 
ctnnbination  of  sinusoidal  dither  frequency  and  magnitude.  Criteria  are  that  vertical  p-forces  do 
not  exceed  O.lp,  horisontal  p-forces  do  not  exceed  0.2p,  the  aircraft  remains  stable  while  being 
dithered  in  the  fully  functional  configuration,  false  alarms  are  minimised,  failure  identification  time 
is  minimised,  and  travel  limits  on  control  surface  deflections  are  not  violated.  MMAE  performance 
on  ea  Ji  failure  condition  is  analysed  in  detail  to  determine  the  best  dither  for  the  particular  failure, 
then  the  results  of  the  individual  analyses  are  combined  to  arrive  at  a  best  overall  dither.  We  begin 
with  the  longitudinal  channel. 

For  the  right  and  left  elevator  actuator  failures,  a  trend  toward  faster  failure  identification 
times  as  frequency  decreases  is  broken  at  Trial  3  where  u  =  1.6653,  as  seen  in  Figure  4.1  and 
Thble  4.1,  as  well  as  Figure  4.2  and  Table  4.2.  Of  special  note  here  is  that  the  commanded  elevator 
angles  violate  the  limits  given  in  Table  3.2  at  the  low  frequency  dithers  of  Ikials  1,  2,  and  3. 

The  elevator  travel  limit  violation  is  due  to  the  out-of-phase  dither  and  the  effect  of  the 
flight  control  system.  Recall  that  the  longitudinal  flight  control  system  is  divided  into  left  and 
right  channels  (Section  3.2.2).  While  each  channel  commands  its  own  surface,  both  channek  are 
controlling  the  same  aircraft  state,  q,  pitch  rate.  S'  the  pitch  rate  desired  by  both  channels  is  not 
the  same,  extra  elevator  surface  deflection  is  commanded  by  each  flight  control  system  channel 
to  achieve  their  desired,  but  respectively  different,  commanded  pitch  rates.  One  channel  tries  to 
overpower  the  other.  This  is  not  a  problem  at  higher  frequencies  because  of  the  lag  of  the  fli^t 
control  system.  Here,  the  high  commanded  pitch  rate  changes  to  a  low  rate  before  the  elevator  can 
be  conunanded  to  deflect  outside  of  its  limits.  This  lag  effect  ceases  to  keep  elevator  surfaces  within 
limits  at  low  frequencies.  However,  instead  of  stopping  at  the  limit,  our  linearized  discrete-time 
aircraft  truth  model  of  Equation  (3.1)  allows  for  out-of-limit  commands.  Therefore,  responsibility 
lies  with  the  researcher  to  check  the  commanded  surface  deflections  manually.  Routines  to  warn 
of  control  surface  position  and  rate  limits  cotdd  have  been  added  to  the  software,  however,  the 
additional  computational  load  would  increase  the  time  required  to  run  simulations,  and  the  state- 
space  model  provided  by  Simulink  [9]  does  not  facilitate  monitoring  or  modification  of  intermediate 
states  easily. 
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Besides  the  limit  violatioxu  at  low  frequencies,  Figure  4.1  exhibits  a  shallow  sl<^  across 
the  higher  frequencies.  This  would  indicate  that  failure  identification  time  is  not  a  function  of 
^-loading.  Bather,  failure  identification  times  seems  to  be  more  related  to  the  degree  of  surface 
defiection.  Indeed,  detailed  analysis  reveals  that  the  elevator  surfs  vements  occupy  a  greater 
percentage  of  the  defiection  range  on  simulations  yielding  shorter  ideuhification  times  than  of  those 
with  longer  identification  times.  And,  as  discussed  above,  lower  frequency  dithers  result  in  greater 
surface  defiection  for  the  same  dither  magnitude. 

For  the  forward  velocity  sensor  failure,  a  random  cluster  of  failure  identification  times  be¬ 
tween  Trials  4  and  10  is  noted  in  Figure  4.3  and  l^ble  4.3.  This  lack  of  definite  trend  in  failure 
identification  times  for  frequencies  above  w  =  3.3306  rad/sec  may  be  explained  by  the  Bode  plot  of 
forward  velocity  response  to  elevator  defiections  |u((4;)/£e((^)|  shown  in  Figure  B.l.  The  response 
beyond  u  =  3  rad/sec  is  more  than  50  dB  below  the  peak  magnitude.  With  such  a  small  response  to 
elevator  input,  one  would  expect  the  random  system  inputs  to  exercise  more  infiuence  over  MMA£ 
failure  identification  times  than  the  elevator  dithers. 

At  the  lower  end  of  the  spectnun  for  dither  frequency,  failure  identification  times  go  solidly 
to  0.10  sec,  which  is  the  shortest  time  possible  with  our  MMAE  design  (see  Subsection  3.3.1).  Our 
conclusion,  therefore,  is  that  short  forward  velocity  failure  identification  times  will  be  realized  with 
decreasing  dither  frequency. 

For  the  angle  of  attack  sensor,  failure  identification  times  are  well  correlated  with  the  Bode 
plot  of  angle  of  attack  response  to  elevator  input  shown  in  Figure  B.2.  Note  that  the  |a(ci;)/fe((t;)| 
response  has  a  steep  drop-off  after  u  =  7  rad/sec.  This  frequency  corresponds  closely  with  Ttial  5 
of  Table  4.4.  Failure  identification  times  at  lower  frequencies  are  consistently  short  while  those  at 
higher  frequencies  are  an  order  of  magnitude  longer.  Thus,  we  see  a  close  correlation  between  the 
|a(ci;)/je(<^)|  magnitude  response  and  angle  of  attack  fiulure  identification  time. 

For  the  pitch  rate  sensor  failure,  a  different  trend  is  noted.  Figure  4.5  and  l^ble  4.5  show 
a  definite  reversal  of  the  trend  towards  shorter  failure  identification  times  with  lower  frequency 
dithers.  A  study  of  the  Bode  plot  for  pitch  rate  response  to  elevator  input  |9(b;)/fe(<^)|  shown 
in  Figure  B.3  does  not  explain  this  reversal.  The  magnitude  response  might  suggest  a  failure 
identification  time  trend  that  is  inverse  to  that  of  actual  testing,  considering  only  the  discrete 
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firequendet  tested.  That  is,  the  dip  in  response  nuqpiitnde  between  0.5  rad/sec  and  3  rad/sec 
might  lead  one  to  predict  longer  failure  identification  times  for  these  fiequendes.  However,  this  is 
not  the  case.  Rather,  the  best  identification  times  are  found  in  this  interval. 

Why  does  the  pitch  rate  sensor  behave  differently  from  the  other  sensors?  An  explanation  is 
supported  by  the  fact  that  the  pitch  rate  state  is  controlled  by  and  provides  feedback  to  the  flight 
control  system.  A  thorough  discussion  is  found  in  Section  5.2. 

For  the  pitch  angle  sensor  failnre,  the  trend  is  consistent  with  that  found  for  the  forward 
velodty  sensor.  Indeed  these  two  sensors  have  similar  responses  to  elevator  inputs  (see  Figures  B.4 
and  B.l)  and  ndther  sensor  provides  feedback  to  the  flight  control  system. 

With  the  characteristics  of  each  type  of  failure  identification  in  mind,  we  now  move  toward 
selecting  the  optimal  frequency  and  magnitude  of  the  sinusoidal  dither  to  be  applied  to  the  longitu¬ 
dinal  channel.  Only  one  set  of  parameters  will  be  chosen  because  (a)  elevators  are  the  only  wiamii 
of  inputting  dithers,  and  (b)  we  must  limit  the  scope  of  our  research.  A  better  solution  may  be  to 
superimpose  one  sinusoid  of  differing  frequency  and  magnitude  on  another  sinusoid,  by  means  of  a 
linear  combination  for  example. 

For  the  elevators,  the  limiting  factor  is  control  surface  travel  limit  violations  at  low  frequencies. 
The  best  dither  could  be  at  a;  =  3.3306  or  u  =  6.6611.  Both  Trials  4  and  5  of  Table  4.1  show  that 
the  vertical  p-limits  of  0.1  g  are  not  violated  except  in  THal  4  where  -2(t  is  0.1058,  accepted  as 
within  limits  due  to  the  course  discretisation  of  the  test  parameter  space.  The  forward  velocity 
sensor,  angle  of  attack  sensor,  and  pitch  angle  sensor  failures  are  more  quickly  identified  at  very 
low  frequencies.  So,  this  factor  will  direct  us  to  a  lower  frequency,  if  given  a  choice. 

Finally,  the  fastest  pitch  angle  failure  identification  time  is  detected  at  a  dither  frequency 
of  u  =  1.6653.  However,  the  vertical  p-limits  are  broken  at  this  frequency,  u  shown  in  Ikial  3  at 
Tbble  4.5.  The  elevator  failure  identification  time  at  this  frequency  is  not  significantly  different  from 
that  ofu  =  3.3306.  The  elevator  surface  travel  limit  violation  at  this  frequency  may  be  resolved  by 
lowering  the  magnitude  of  dither  at  u  =  1.6653,  which  must  be  done  anyway  to  reduce  p-loading 
to  within  limits.  So,  we  are  left  with  a  choice:  in  order  to  meet  the  vertical  p-limits,  do  we  lower 
the  dither  magnitude  at  a;  =  1.6653,  or  do  we  increase  the  dither  frequency  to  u;  =  3.3306? 
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T»ble  4.15  Comparison  of  Redudxig  Dither  Magnitude  versus  Increasing  Dither  FVequency  to 
Reduce  Vertical  p-forces. 


Trial 

3 

Elevator  Dither 

Magnitude  [deg/sec] 

6.00 

F^quency  [rad/sec] 

1.6653 

Failure  ID  Time  [sec] 

A1 

0.24 

A2 

0.23 

SI 

0.58 

S2 

0.10 

S3 

0.33 

S4 

0.93 

Vertical  Acceleration  [p’s] 

-t‘2<r 

0.1053 

— 2<r 

-0.1512 

0.0839 


0.0722  0.0878 

-0.0777  -0.1058 


Additional  simulations  with  w  =  1.6553  and  dither  magnitudes  of  5  deg/sec  and  4  deg/sec 
were  made.  The  results  are  found  in  Appendix  D  but  are  compiled  in  Table  4.15  for  our  convenience. 
Trials  3.1,  3.2,  and  4  all  fall  within  p-limits.  Trial  3.2  merely  illustrates  the  trend  toward  longer 
failure  identification  times  with  decreasing  dither  magnitude.  So,  of  Trial  3.1  (reduced  magpiitude) 
and  Trial  4  (increased  frequency),  which  yields  better  failure  identification  times  in  general?  Ebccept 
for  the  forward  velocity  sensor.  Si,  all  failures  were  identified  more  quickly  at  a  dither  with  a 
magnitude  of  6  deg/sec  and  at  a  frequency  of  3.3306  rad/sec.  Thus,  our  optimal  longitudinal 
dither  is  concluded  and  stated  in  Equation  (4.6),  on  page  4-42. 

Our  next  task  is  to  find  an  optimal  dither  for  the  lateral  channel  by  specifying  a  sinusoidal 
frequency  and  magnitude.  This  dither  will  be  applied  to  both  channels  of  the  roll  rate  command 
and  both  channels  of  yaw  angle  command,  as  shown  in  Figure  3.1. 

First,  we  consider  the  aileron  actuator  failures.  Unlike  the  elevators,  the  aileron  surfaces  were 
never  commanded  outside  of  their  limits  (see  Table  3.2)  for  any  set  of  test  conditions.  However,  63% 
of  their  range  is  used  when  dithering  at  the  low  frequency  of  0.2262  rad/sec  and  roll  rate  dither 
magnitude  is  6  rad/sec.  As  seen  in  Figures  4.7  and  4.8  and  Tables  4.7  and  4.8,  shorter  failure 
identification  times  are  realized  with  lower  frequency  dithers.  As  frequency  decreases  though,  the 
“brick  wall”  dfect  is  seen  at  about  Trial  5  where  u  =  3.6193.  Similar  analysis  applies  to  the  rudder 


octaotor  faihrea.  Trial  5  marks  tke  point  where  little  gain  in  failure  identificatkoi  time  is  realised 
for  a  large  penalty  in  horisontal  p-loading.  Still,  the  ±2ir  bonnds  of  Ikial  5  are  outside  of  the  ±0.20 
horisontal  p-limit.  Frequency  must  be  increased  to  7.2386  rad/sec,  as  in  Trial  7,  before  the  ±2<r 
bounds  of  p-loading  are  within  limits. 

The  ndeahp  angle  tensor  fiulnre  data  is  shown  in  Figure  4.11  and  Table  4.11.  This  sensor 
provides  feedback  to  the  flight  control  system  so  that  the  sideslip  angle  aircraft  state  may  be 
controlled.  The  erratic  distribution  of  failure  identification  times  at  both  ends  of  the  spectrum 
might  be  explained  by  the  poor  quality  of  sideslip  angle  sensor  measurements.  As  seen  in  Table  3.3 
on  page  3-7,  the  variance  associated  with  the  sideslip  an^e  sensor,  Rfl,  is  the  worst  of  all  angle 
sensors.  If  sensor  measurements  are  very  noisy,  the  Kalman  filter  is  more  inclined  to  believe  its 
internal  model  rather  than  the  information  found  in  incoming  measurements.  The  fully  functional 
filter  residuals  generally  remain  unchanged  in  character  through  an  induced  sideslip  angle  sensor 
failure,  except  for  the  residual.  This  residual  generates  a  short  duration  spike  which  is  likely  to 
be  disregarded  by  the  Kalman  filter.  The  only  remaining  clue  to  a  change  in  performance  is  found 
in  the  residual  of  the  filter  hypothesising  a  sidesUp  angle  sensor  failure,  which  inunediately  goes 
to  sero-mean,  low  variance.  There  is  a  definite  shift  of  failure  times  to  the  right  with  increasing 
dither  frequency  in  Figure  4.11.  This  information  is  useful  in  helping  us  to  select  Ikial  4  or  5  as 
having  the  best,  most  reliable  dither  parameters. 

For  the  roll  rate  sensor  failure.  Figure  4.12  and  Table  4.12  show  that  the  identification  times 
are  cliutered  aroimd  0.7  and  0.8  seconds.  Were  it  not  for  Trial  1,  no  trend  could  be  detected. 
Therefore,  we  will  not  conclude  that  there  is  a  trend  except  that,  regardless  of  frequency  chosen, 
an  identification  time  of  around  0.75  seconds  will  result.  Again,  this  sensor  provides  feedback  to 
the  fiight  control  system. 

The  roll  angle  sensor  failure  identification  times  can  be  correlated  to  the  Bode  plot  of 
|^(t;)/5.((i;)|  in  Figure  B.7.  At  low  frequencies  there  are  high  gains  and  short  identification  times. 

The  ±2e  trace  of  Figure  4.13  has  a  ‘‘Z’’-shape  around  Trials  6,  7,  8,  and  9.  This  gives  the 
impression  that  there  is  some  notch  dither  frequency  where  the  MMAE  has  better  response  than  at 
the  surrounding  dither  frequencies.  This  is  not  likely  to  be  the  case.  Random  effects  of  wind  gusting 
may  play  a  bigger  part  in  failure  identification  times  since  the  aileron  surfaces  are  commanded  to 
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deflect  over  only  8%  of  there  travel  range  for  each  of  Trials  6  through  10.  The  useful  conclusion 
here  is  that  lower  frequency  dithers  yield  better  failure  identification  times. 

The  yaw  rate  sensor  failwrt  is  a  unique  situation.  Although  the  yaw  rate  sensor  provides 
feedback  to  the  fli^t  control  system,  the  low  frequency  output  of  this  sensor  is  attenuated  by  the 
washout  filter.  This  is  a  high  pass  filter  with  a  break  frequency  at  about  1  rad/sec.  The  impact 
is  that,  for  rudder  dither  frequencies  below  1  rad/sec,  a  yaw  rate  sensor  failure  might  be  treated 
like  the  failure  of  a  sensor  that  is  not  providing  feedback  to  the  fli^t  control  system.  That  is, 
imder  this  condition,  scalar  residual  monitoring  in  the  fnlly-functional-aircraft  filter  could  be  used 
effectively. 

Table  4.14  and  Figure  4.14  reveal  a  definite  “Z^-shape  pattern  with  Trials  1,  2,  and  3  making 
up  the  top.  Trials  3,  4,  and  5  defining  the  diagonal,  and  Trials  5,  6,  and  7  tracing  the  bottom. 
An  interesting  correlation  is  made  with  the  Bode  plot  of  Figure  B.12.  Specifically,  the  magnitude 
transition  from  the  local  TwitiimiiTn  at  0.4  rad/sec  to  the  local  maximum  at  3.7  rad/sec  contains  the 
frequencies  of  Trials  3,  4,  and  5,  the  diagonal  of  the  “Z”  of  Figure  4.14.  Further  study  provides  one 
with  convincing  evidence  that  the  Bode  log*magnitudeplot  correlates  with  the  failure  identification 
times.  So,  even  though  the  yaw  rate  sensor  provides  feedback  to  the  flight  control  system,  because 
the  low  frequencies  are  attenuated,  this  allows  the  MMAE  response  to  a  yaw  rate  sensor  failure  to 
be  more  like  that  of  a  sensor  that  does  not  provide  feedback  to  the  flight  control  system.  The  "Z” 
of  Figure  4.14  is  valid,  so  our  best  dither  for  the  yaw  rate  sensor  failure  is  that  of  Trial  5. 

In  stunmation,  the  lateral  channel  components  compel  us  to  choose  the  dither  frequency  of 
Trial  5,  3.6193  rad/sec,  as  the  best  candidate  for  optimal  dither.  However,  the  horisontal  y-load 
caused  by  the  parameters  of  Trial  5  are  outside  of  the  ±0.2g  limits.  Again,  we  must  decide  whether 
to  lower  the  dither  magnitude  or  increase  the  dither  frequency  to  that  of  Trial  7  in  order  to  meet 
this  criterion.  Table  4.16  presents  the  compiled  results  of  varying  dither  magnitude  at  the  Trial  5 
frequency,  along  with  the  results  of  Trial  7  for  comparison.  The  details  of  Trials  5  through  5.3  are 
presented  in  Figures  D.7  through  D.14,  with  companion  Tables  D.7  through  D.14,  in  Appendix  D. 
Bjeferring  to  Table  4.16,  we  see  that  the  5-series  trial  with  the  lowest  fsdlure  identification  times 
and  p-forces  within  limits  is  Trial  5.2.  The  -\-2(r  bound  is  violated  but  judged  acceptable  in  light 
of  the  cousely  discretised  dither  magnitude  space.  Comparison  of  the  failure  identification  times 
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Ikble  4.16  Comparison  of  Reducing  Dither  Magnitude  versas  Increasing  Dither  Frequency  to 


Reduce  Horisontal  p-forces. 


Ikial 

5 

5.1 

5.2 

5.3 

7 

Aileron  Dither 

■■ 

Magnitude  [deg/sec] 

6.00 

3.00 

2.00 

6.00 

Frequency  [rad/sec] 

3.6193 

3.6193 

3.6193 

3.6193 

7.2386 

Rudder  Dither 

■■ 

■■ 

Magnitude  [deg/sec] 

6.00 

4.00 

6.00 

Frequency  [rad/sec] 

3.6193 

3.6193 

3.6193 

3.6193 

7.2386 

Failure  ID  Time  [sec] 

■■1 

A3 

0.52 

0.79 

1.87 

0.84 

A4 

0.30 

0.36 

0.99 

0.75 

AS 

0.90 

1.20 

1.72 

2.75 

A6 

0.53 

1.00 

1.40 

2.38 

5.34 

S5 

1.77 

2.42 

2.78 

3.53 

3.43 

S6 

0.70 

0.75 

0.69 

0.73 

0.87 

S7 

0.80 

0.27 

0.22 

1.51 

1.19 

S8 

0.75 

0.85 

0.97 

1.11 

1.17 

Horisontal  Acceleration  [p’s] 

-f-2<r 

0.3304 

0.2631 

0.2043 

0.1476 

0.1954 

-2<r 

•0.2989 

•0.1802 

-0.1399 

-0.1343 

-0.1784 

in  'Drial  5.2  with  Tlrial  7  tells  us  that  the  best  choice  is  to  reduce  the  dither  magnitude  rather  than 
increase  the  dither  frequency  to  meet  the  p-limits. 

Therefore,  the  optimal  dither  for  the  lateral  channel  will  have  magnitude  3  deg/sec  and 
frequency  3.6193  rad/sec  for  the  roll  rate  command,  and  magnitude  3  degrees  and  frequency  3.6193 
rad/sec  for  the  sideslip  angle  command.  Actual  performance  of  our  optimal  dither  is  evaluated  in 
the  next  section. 

Possibly,  a  better  solution  for  the  lateral  channel  would  feature  separate  dither  parameters 
for  the  rudder  and  ailerons.  Indeed,  the  roll  rate  and  roll  angle  aircraft  states  respond  to  low 
frequency  dithers,  whidi  could  be  applied  to  the  sdlerons,  while  the  higher  frequency  of  THal  5 
could  be  applied  to  the  rudders  for  quick  response  of  the  MMAE  to  sideslip  angle  sensor  and  yaw 
rate  sensor  failures.  Furthermore,  two  sinusoids  of  different  frequencies  and  magnitude  could  be 
superimposed  to  stimulate  the  MMAE  to  respond  to  both  high-  and  low-frequency-sensitive  failures. 
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A  much  num  complicated  analysif  ia  required  to  investigate  these  proposals,  so  in  the  interest  of 
time,  they  are  not  pursued  in  this  thesis. 

4.2.2  Optimal  Dither.  The  optimal  dither  performance  is  shown  in  Figure  4.15.  Eiadi 
plot  shows  the  response  of  the  MMAE  for  the  filter  that  matches  the  fSsilure  induced.  An  expanded 
presentation  is  provided  in  Appendix  E.  The  command  inputs  are  dithered  with  the  signals  shown 
in  Equation  (4.6): 


Right  pitch  rat?  command 
Left  pitch  rate  command 
Right  roll  rate  command 
Left  roll  rate  command 
Right  sideslip  angle  command 
Left  sideslip  angle  command 


6.0  X  sin(3.3306t  +  ^.r)  deg/sec 
6.0  X  sin(3.3306t  +  ^«i)  deg/sec 
3.0  X  sin(3.6193f  +  ^.r)  deg/sec 
3.0  X  sin(3.6193t  +  deg/sec 
3.0  X  sin(3.6193t  +  ^)  deg 
3.0  X  sin(3.6193t  +  d^ri)  deg 


(4.6) 


Note  that  the  longitudinal  sensor  responses,  S2,  S3,  and  S4,  are  not  as  fast  as  would  be  predicted 
by  Trial  4  of  Tables  4.4  through  4.6.  This  may  be  attributed  to  two  factors.  Consider  that  Trial 
4  of  Tables  4.4  through  4.6  had  elevator  dithering  at  w  =  3.3306  rad/sec  and  aileron  dithering  at 
u  =  1.0896  rad/sec,  a  lower  frequency  than  that  of  the  elevators.  Recall  that  the  ailerons  are  cross 
coupled  into  the  longitudinal  channel  according  to  terms  in  B  of  Equation  (3.1).  Next,  recall  that 
longitudinal  sensors  had  the  best  failure  identification  times  at  lower  frequencies  such  as  w  =  0.8326 
(see  Trial  2  of  Tables  4.3  and  4.6)  and  v  =  1.6653  (see  IMal  3  of  Tables  4.4  and  4.5).  The  two  factors 
of  low  frequency  aileron  dithering  and  aileron  cross  coupling  into  the  longitudinal  axis  can  account 
for  the  seemingly  good  failure  identification  times  of  IMal  4.  Once  the  low  frequency  component  was 
removed,  as  in  our  proposed  optimal  dither  (Equation  (4.6)),  the  longitudinal  sensors  responded 
more  slowly  to  the  higher  frequency  as  in  Trial  5  of  Tables  4.4  through  4.6. 

Obviously,  in  the  interest  of  obtaining  consistent  test  results,  our  firequency  response  tests 
should  have  been  conducted  with  the  aircraft  being  subjected  to  only  one  frequency  at  a  time.  The 
base  frequencies  mentioned  in  Section  4.2  should  have  been  identical  for  the  elevators,  ailerons, 
and  the  rudders.  With  the  preceding  analysis  re-accomplished  under  these  conditions,  an  optimal 
dither  would  have  been  more  accurately  predicted.  However,  the  analysis  of  the  preceding  paragraph 
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Time  [sec]  Time  (sec) 


Figure  4.15  MMAE  Filter  Probability  Plots  with  the  Optimal  Dither  Technique. 
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indicates  that  one  might  successfully  use  ailerons  to  induce  the  low-firequency  excitation  into  the 
longitudinal  channel  to  improve  MMAE  response  to  S2,  S3,  and  S4  failures  while  maintaining  a 
higher  frequency,  low-magnitude  dither  on  the  elevators  for  good  elevator  actuator  failure  detection. 
This  is  a  complex  relationship  because  the  aileron  dither  also  affects  failure  identification  times  for 
sensors  S5-S8  and  the  aileron  actuators.  Therefore,  we  restrict  the  design  of  aileron  dither  to 
provide  excitation  for  only  lateral  sensors,  and  elevator  dither  design  to  excite  only  longitudinal 
sensors.  However,  a  linear  combination  tjrpe  of  dither  signal  might  warrant  investigation  in  the 
future. 

4.3  Pilot  Command  Inputs 

During  normal  flying  operations,  the  LAMBDA  pilot  is  constantly  providing  command  inputs 
to  the  flight  control  system.  To  see  what  the  effects  of  his/her  input  commands  are  on  the  aircraft 
in  terms  of  |j-loading  and  MMAE  performance,  flight  data  was  obtained  from  Wright  Laboratories 
[26]  to  apply  to  the  truth  model  and  MMAE  program.  The  command  input  data  provided  was 
in  the  form  of  an  ASCII  file  with  vectors  of  single  channel  stick  inputs  for  pitch  rate,  roll  rate, 
and  sideslip  angle.  The  data  was  recorded  in  real  time  at  60  Hz,  even  though  the  LAMBDA  PCS 
operates  at  50  Hz  as  our  truth  model  does.  To  convert  the  60  Hz  data  to  50  Hz  data,  every  sixth 
datum  was  removed  from  each  vector.  This  method  of  conversion  was  used  in  preference  to  curve 
fitting  and  re-discretizing  because  of  its  simplicity.  Of  more  concern  is  that  these  pilot  inputs  are 
being  applied  against  computer-generated  wind  perturbations  to  which  this  pilot  is  not  reacting. 
Without  actually  flying  an  MMAE-equipped  LAMBDA  in  real-time  simulation,  the  effectiveness  of 
pilot  command  inputs  as  a  dither  technique  will  remain  an  unknown. 

A  further  modification  is  that  the  single  channel  data  for  each  control  axis  was  simply  du¬ 
plicated  and  applied  to  the  two  channels  of  each  control  axis  of  our  truth  model.  The  applied 
command  inputs  are  shown  in  Figure  4.16  along  with  the  p-loadings  calculated  by  our  truth  model. 

The  data  series  was  taken  from  a  pitch-up  maneuver.  The  complete  maneuver  consists  of 
a  positive-negative  doublet  applied  to  the  pitch  rate  input,  followed  by  commands  to  level  and 
straighten  the  flight  path.  The  portion  of  data  shown  in  Figure  4.16  and  used  in  the  present 
simulation  is  only  the  part  to  level  and  straighten  the  flight  path.  The  ordinate  labels  are  defined 
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ai  follows:  Ecmd  Rt  -  right  channel  pitch  rate  command  (E  for  elevator);  Ecmd  Lt  -  left  channel 
pitch  rate  command;  Az  -  vertical  acceleration;  Acmd  Rt  -  right  channel  roll  rate  command  (A  for 
aileron);  Acmd  Lt  -  left  channel  roll  rate  command;  Rcmd  Rt  -  right  channel  sideslip  angle  conunand 
(R  for  rudder);  Rcmd  Lt  -  left  channel  sideslip  an^  command;  and  Ay  -  horizontal  acceleration. 
Each  of  the  failed  conditions  are  applied  to  the  truth  model  at  4.0  seconds.  The  MMAE  filter 
probability  traces  are  shown  in  Figure  4.17. 

Only  one  Monte  Carlo  run  was  made  for  each  failure  condition  because  we  desire  to  present 
a  representation  of  what  would  happen  on  one  real  fiight,  without  the  added  complications  of 
compressing  many  runs  into  a  plot  of  averages.  Wind  was  included  at  the  same  strength  as  for 
previous  simulations.  Note  the  difficulty  the  fully  functional  filter  has  in  maintaining  lock  on  a 
fully  functional  aircraft.  Even  so,  no  false  declarations  were  made.  For  actuator  failures  only,  the 
right  elevator  and  left  aileron  were  identified  in  2.24  and  1.04  seconds,  respectively,  while  the  left 
elevator  and  right  aileron  were  not  correctly  identified.  Figure  4.18  shows  a  solid  50-50  sharing  of 
probability  between  failed  rudder  filters  when  either  rudder  is  failed  by  itself.  Because  neither  one 
nor  the  other  attained  a  probability  of  greater  than  Ptrig  =  O-S*  failure  was  identified.  However, 
the  algorithm  has,  in  fact,  correctly  identified  that  a  rudder  failure  has  occurred  in  both  cases,  but 
it  is  not  sure  which  one  failed.  This  is  a  clear  indication  of  the  need  for  out-of-phase  dithers  when 
cross-coupling  terms  are  not  included  in  the  model. 

All  sensors  were  correctly  identified  and  all  identification  times  except  that  of  the  sideslip 
angle  sensor  failure  were  better  than  those  of  the  optimal  dither  in  Figure  4.15.  However,  note  that 
the  vertical  acceleration  limit  of  0.1  g  has  been  severely  violated  in  the  Az  plot  of  Figure  4.16.  Also, 
the  horizontal  p-limit  of  0.2  g  is  severely  violated  in  the  Ay  plot.  These  violations  disqualify  this 
particular  pilot  dither  routine  from  being  called  an  "opiimal  dither”.  Note  finally  that  the  spiking 
beginning  at  9  seconds  in  the  S8  plot  is  a  result  of  the  aircraft  going  unstable.  This  phenomenon 
is  discussed  in  Section  5.1. 
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Cmd  Inputs  (degrees/Sec]  and  G-forces  [g’s] 


Figure  4.16  Command  Input  Plots  of  LAMBDA  Pilot’s  Effort  to  Fly  Straight  and  Level. 
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Induced  failure  in  AS  at  4.00  s. 


Result  of  single  njn. 


2  4  6  8  10  12 


■ 


6  8  10  12 


4  6  8  10  12 


2  4 


8  10  12 


4  6  8  10  12 


2  4  6  8  10  12 


2  4 


8  10  12 


4  6  8  10  12 


4  6  8  10  12 


2  4  6  8  10  12 


2  4  6  8  10  12 


2  4  6  8  10  12 

Time  [sec] 


4  6  8  10  12 


4  6  8  10  12 


4  6  8  10  12 

Time  [sec] 


Figure  4.18  MMAE  Filter  Probability  Plots  for  all  Bank  0  Filters  when  only  the  Bight  Rudder 
Failure  is  Induced  at  4.00  seconds.  Command  Input  is  Pilot’s  Effort  to  Fly  Straight 
and  Level.  Note  Shared  Probability  between  Right  and  Left  Rudder  Filters. 
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Dual  Failmre  Performance 

The  optimal  dither  technique  of  Subsection  4.2.2  is  used  to  command  the  truth  model  when 
it  is  subjected  to  two  failures  spaced  apart  by  1  second.  All  combinations  of  all  fourteen  possible 
actuator  and  sensor  failures  are  tested  in  simulation.  Criteria  for  successful  performance  is  that  a 
filter  hypothesising  both  the  induced  first  failure  and  the  induced  second  failure  holds  a  window- 
averaged  probability  (see  Subsection  3.3.1)  above  the  trigger  limit  of  Ptrig  =  0.5  at  the  end  of  the 
12  second  simulation,  with  no  false  alarms  in  between. 

The  presentation  format  allows  the  reader  to  view  avenges  of  ten  Monte  Carlo  runs.  As  an 
example,  consider  Figure  4.19.  When  the  fault  declarations  are  consistent  from  run  to  run,  this 
format  is  clear  and  easily  understood.  Each  pair  of  plots  in  a  row  are  the  average  probabilities  of 
the  set  of  ten  runs  with  the  same  failure  parameters.  The  plot  in  the  first  column  is  the  probability 
of  the  filter  that  was  declared  to  have  the  first  failure.  This  filter  is  a  secondary  filter  in  level-0, 
which  becomes  the  primary  filter  in  level- 1  at  the  time  of  the  first  failure  declaration.  The  plot 
in  the  second  column  starts  off  as  the  probability  of  a  secondary  filter  in  level-0  but  changes  to 
the  secondary  filter  in  level-1  which  hypothesises  the  first  failure  detected  and  the  second  failure 
detected.  The  change  is  denoted  by  a  vertical  dash-dot  line.  This  compact  format  eliminates  the 
need  to  display  all  of  the  non-relevant  filter  probabilities  from  both  level-0  and  level-1.  However, 
this  format  does  become  confusing  when  the  order  of  MMAE  fault  declaration  changes  from  run  to 
run.  In  this  case,  acceptable  performance  may  have  been  achieved,  but  the  only  way  to  represent 
this  graphically  is  to  show  probabilities  from  each  Monte  Carlo  nm.  Therefore,  a  short  narrative 
is  given  to  make  clear  what  is  not  evident  in  the  plots. 

Two  pages  are  devoted  to  all  of  the  simulations  with  identical  first  failures.  The  first  page 
of  the  pair  shows  performance  with  actuators  as  the  second  failures  (Figure  4.19);  the  second  pi^e 
shows  performance  with  sensors  as  second  failures  (Figure  4.20). 

When  the  first  failure  is  of  the  ripAt  elevator  actaaior,  Al,  all  actuators  as  second  failures  are 
successfully  identified.  A2,  the  left  elevator  actuator,  is  identified  as  the  second  failure  0.56  seconds 
after  it  is  induced.  This  is  a  longer  time  that  it  took  to  identify  A2  as  the  first  failure,  as  shown 
in  Figure  4.15  even  though  MMAE  probabilities  seem  to  be  solidly  at  steady  state  after  the  first 
failure.  This  extended  failure  identification  time  may  be  explained  by  noting  that  the  filter  timing 
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proceu  favors  the  identification  of  a  fhlly  functional  filter  which  is  still  present  in  the  level-1  bank. 
So,  when  the  second  failure  occurs,  probability  must  not  only  be  transferred  to  the  new  dual  failure 
filter,  it  must  avoid  going  bade  to  the  fully  functional  filter. 

Another  explanation  for  the  longer  identification  time  required  for  a  second  failure  is  that 
this  failure  is  induced  at  5  seconds  in  the  dual  tests  rather  than  at  4  seconds,  as  in  the  the  single 
failure  tests.  The  impact  is  that  the  dither  signal  inputs  are  making  different  transitions  at  these 
two  times.  The  conjecture  is  that  a  failure  is  more  quickly  identified  if  it  is  induced  during  a  period 
when  the  time  differential  of  the  input  is  high.  To  draw  a  parallel,  this  condition  exists  between 
two  simulations  with  different  dither  signal  magnitudes.  In  the  cases  shown  in  Appendix  D,  it  is 
dear  that  the  higher  magnitude  inputs  result  in  quicker  failure  identification  times,  as  antidpated. 

The  rest  of  the  dual  failure  probability  plots  are  presented  in  Appendix  F,  which  has  the  filter 
codes  of  Thble  3.4  re-printed  as  an  aid,  but  discussion  is  presented  below.  All  dual  failures  were 
correctly  identified  and  no  false  alarms  were  detected  with  the  left  elevator  actaator  as  the  first 
fulure.  Figure  F.l  shows  good  MMAE  performance  when  the  left  elevator  fails  first  and  actuators 
fail  second.  Figure  F.2,  as  consistent  with  Figure  4.20,  reveals  that  excellent  identification  of 
longitudinal  sensors  is  obtained  when  one  elevator  actuator  is  failed.  Loss  of  one  elevator  actuator 
gives  the  remaining  control  surface  complete  control  of  the  longitudinal  states  without  competition 
from  out-of-phase  deflections  the  opposite  surface.  The  result  is  that  these  states  are  excited  more, 
which  leads  to  enhanced  failure  detection. 

All  dual  failures  were  correctly  identified  and  no  false  alarms  were  detected  with  the  ri^i 
aileron  actuator  as  the  first  failure.  Figures  F.3  and  F.4,  however,  do  not  necessarily  give  that 
impression.  Consider  the  top  row  of  two  plots  in  Figure  F.3.  The  actual  results  are  that  the  A1 
filter  was  identified  as  the  first  failure  in  2  of  the  6  Monte  Carlo  runs  in  which  the  A3  filter  was 
correctly  identified  second.  Similarly,  in  the  plots  of  row  7  of  Figure  F.4,  the  corresponding  test 
result  was  that  the  S7  filter  came  first  in  3  of  10  runs. 

Understanding  the  hi^^y  condensed  information  contained  in  the  dual  failure  plots  takes 
careful  consideration.  The  reader  is  encouraged  to  pause  at  this  point  and  refer  back  to  the 
hierarchical  structure  in  Figure  1.2  on  page  1-14.  Recall  that  all  level-0  filters  h]rpothesi8e  only  one 
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Figure  4.19  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Right  Elevator  Actuator  Failing 
at  4.00  sec.  and  Each  Actuator  Failing  at  5.00  sec. 
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Figure  4.20  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Ri^t  Elevator  Actuator  Failing 
at  4.00  sec.  and  Each  Sensor  Failing  at  5.00  sec. 
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or  sero  componeiift  failures.  When  two  unidentified  failures  are  present,  as  is  the  case  when  the  first 
failure  oi  our  test  is  not  identified  in  less  than  one  second,  the  MMAE  algorithm  has  a  dunce.  In 
the  present  situation,  it  may  choose  the  A3  failure  and  switch  to  the  A3  bank  or  it  may  choose  the 
Al  failure  and  switch  to  the  A1  bank.  Upon  switching  to  a  new  bank,  our  data  gathering  routine 
continues  to  use  the  same  15  storage  locations  to  track  probabilities  of  level-l  filters  as  it  did  to 
track  level-0  probabilities.  Data  for  the  Al  filter  in  levd-O  is  appended  with  data  for  the  A3A1  filter 
when  the  bank  is  switched  to  the  A3  level-1  bank.  Data  for  the  Al  filter  continues  to  be  Al  filter 
data  when  the  bank  is  switched  to  the  Al  level-1  bank.  This  is  not  a  problem  when  all  of  the  ten 
Monte  Carlo  runs  switch  banks  in  the  same  order.  However,  if  there  is  an  order  reversal  between 
runs,  the  reader  must  realise  that  the  averaged  probability  plot  starting  out  as  the  A3  filter  ends 
up  as  averaged  probability  composed  of  80%  from  the  A3  filter  (when  the  MMAE  switched  to  bank 
A3  first  in  8  of  10  runs)  and  20%  from  the  A1A3  filter  (when  the  MMAE  switched  to  bank  Al  first 
in  2  of  10  runs). 

Massive  amounts  of  data  would  have  to  be  published  in  order  to  gain  a  completely  dear 
understanding.  Therefore,  this  reliable  and  detailed  narrative  should  be  followed  dosely. 

All  dual  failures  were  correctly  identified  and  no  false  alarms  were  detected  with  the  left 
aileron  actuator  as  the  first  failure.  Ikends  of  Figures  F.5  and  F.6  are  similar  to  those  for  the  right 
aileron  actuator  as  the  first  failure. 

AU  dual  failures  were  correctly  identified  with  the  right  rudder  actuator  as  the  first  failure. 
However,  false  alarms  of  a  left  rudder  actuator  failure  were  detected  when  the  second  failure  was 
the  yaw  rate  sensor,  S8.  This  is  to  be  expected  since  the  aircraft  becomes  unstable  with  a  yaw  rate 
sensor  failure;  see  Section  5.1.  Detailed  data  from  simulations  with  these  failed  components  show 
that  the  false  alarms  came  up  after  10  seconds,  wdl  after  the  two  correct  identificatioiu  were  made. 

All  dual  failures  were  correctly  identified  with  the  left  rudder  actuator  as  the  first  failure. 
On  one  run  with  the  left  rudder  actuator  failed  first  and  the  right  aileron  failed  second,  a  unusual 
event  occurred.  A  left  aileron  actuator  failure  was  falsely  identified  first,  the  right  aileron  actuator 
failure  was  correctly  identified  second  and  subsequently,  9  failure  status  switches  occurred  between 
the  A4-A3  filter  and  A4-A6  filters.  Both  of  these  filters  are  incorrect.  The  correct  final  filter  should 
be  the  A6-A3  filter  or  the  A3-A6  filter,  depending  on  the  order  of  correct  failure  identification. 
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Since  the  incorrect  filter  wai  identified  first,  the  MMA£  switched  to  the  wrong  levd-l  bank  which 
contained  neither  of  the  correct  filters  that  match  the  actual  dual  failure  status.  As  a  result,  the 
MMAE  became  indecisive  about  the  next  best  decision,  given  that  the  absolute  best  choice  was  not 
available.  This  accounts  for  the  wavering  of  probability  on  the  row  3  plots  of  Figure  F.9.  There 
were  three  runs  with  false  alarms  for  the  right  rudder  actuator  when  the  yaw  rate  sensor  was  failed 
second.  This  is  easily  attributed  to  the  aircraft  instability  caused  by  the  loss  of  the  yaw  rate  sensor 
feedback  to  the  fiight  control  system  (see  Section  5.1).  The  only  peculiarity  is  that  there  are  fewer 
false  alarms  when  the  yaw  rate  sensor  is  failed  along  with  a  rudder  actuator.  This  does  make  sense 
when  one  considers  that  the  fii^t  control  system  uses  the  rudder  actuators  to  induce  this  aircraft 
instability. 

All  dual  failures  were  correctly  identified  with  the  forward  velocitif  tensor  as  the  first  failure. 
On  one  run  with  the  right  aileron  actuator  failing  second,  the  left  aileron  was  incorrectly  identified  as 
the  first  failure,  the  right  aileron  was  correctly  identified  as  the  second  failure.  Again,  the  inccnrect 
first  failure  declaration  prohibited  the  MMAE  from  declaring  the  correct  dual  failure  status  because 
the  selected  level-1  bank  of  elemental  filters,  having  a  failed  A4  as  its  primary  hypothesis,  does  not 
include  the  correct  dual  failure  hypotheses  of  A3-S1  or  S1-A3.  MMAE  filter  probability  shifts 
between  filters  A4-A3,  A4-S1,  and  A4-FF  six  times  before  the  end  of  this  one  particular  simulation. 
Proper  detections  occurred  on  all  other  runs  with  the  same  failure  parameters.  The  yaw  rate 
sensor  as  the  second  failure  produced  4  false  alarms  of  the  right  aileron  actuator  in  3  of  10  runs. 
In  all  cases,  the  first  two  failures  declared  were  correct,  with  the  false  alarms  coming  at  a  later 
time,  which  we  will  consider  as  sufficient  criterion  fm  proper  MMAE  performance  when  a  yaw  rate 
sensor  failure  is  involved.  See  Figures  F.ll  and  F.12. 

There  is  a  software  "bug”  that  was  corrected  by  forcing  the  MMAE  algorithm  to  change 
filter  banks  only  once.  The  problem  is  that  the  algorithm  switches  filter  banks  on  every  failure 
declaration.  The  software  correction  prohibits  a  switch  to  another  bank  after  two  failures  have 
been  declared.  If  bank  changes  were  allowed  on  every  failure  declaration,  dual  failures  would  cause 
constant  switching  between  level- 1  banks  without  settling  on  just  one  filter  hypothesising  both 
failures.  On  the  other  hand,  if  the  MMAE  needs  to  switch  banks  more  than  once,  it  is  deduced 
that  the  system  has  probably  failed  any  test  proposed  in  this  research.  Had  this  limitation  been 
lifted,  an  identification  of  the  A4-FF  filter  would  have  led  to  a  switch  to  the  level-O  bank.  The 
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oMKiitiiiutj  to  identify  the  correct  dual  faihiic  itatns  might  then  have  been  taken.  This  limitaticn 
will  be  suspended  to  iUnstrate  an  important  MMAE  capability  as  dual  &ihires  with  sideslip  an^ 
sensors  are  analysed  shortly. 

All  dual  failures  were  correctly  identified  with  the  angle  of  attack  sensor  as  the  first  &ilure. 
There  were  only  three  false  alarms  of  a  right  aileron  actuator  after  correct  dual  ftulure  status  was 
declared  when  the  yaw  rate  sensor  failed  second.  The  correct  dual  ftilure  status  was  declared 
following  these  false  alarms  as  well.  See  Figures  F.13  and  F.14. 

All  dual  fiulures  were  correctly  identified  with  the  pitch  rate  aenaor  as  the  first  failure.  Only 
once  did  the  MMAE  identify  the  left  aileron  as  bdng  failed  second  when  it  should  have  identified  the 
ri^  aileron.  Note  that  the  algorithm  correctly  identified  that  an  aileron  failure  had  occurred,  but 
it  required  scnne  additional  time  to  disambiguate  between  a  right  and  a  left  aileron  failure.  This 
is  observed  as  a  recurrent  phenomenon.  The  algorithm  subsequently  identified  the  right  aileron 
correctly  without  further  problems.  See  Figures  F.15  and  F.16. 

AU  dual  failures  were  correctly  identified  with  the  pitch  angle  aenaor  as  the  first  failure.  On 
only  one  run  with  the  left  aileron  actuator  as  the  second  failure  did  the  MMAE  declare  a  failed 
right  aileron.  The  correct  failed  aileron  actnat<u  was  subsequently  identified.  See  Figures  F.17 
and  F.18. 

All  dual  failures  were  correctly  identified  with  the  aideaUp  angle  aenaor  as  the  first  failure 
with  one  exception.  In  this  particular  case  of  one  run,  the  sideslip  angle  sensor  failure  (S5)  was 
induced  first  at  4.00  seconds.  The  right  aileron  actuator  failure  (A3)  was  induced  second  at  5.00 
seconds.  During  this  simulation,  the  MMAE  identi&d  the  failure  of  the  left  ailenm  actuator  (A4) 
incorrectly  at  5.36  seconds  and  switched  to  that  level-l  bank  of  filters.  At  5.88  seconds,  the  MMAE 
identified  the  fully-functional  aircraft  filter  as  the  true  failure  hypothesis,  but  this  time,  on  a  special 
run,  we  allowed  the  algorithm  to  switch  banks  more  than  one  time,  so  the  MMAE  switched  back 
to  the  level-0  bank.  This  action  shown  in  Figure  4.21  illustrates  the  MMAE’s  ability  to  recover 
from  a  false  first  declaration.  As  the  simulation  continued,  the  right  aileron  actuator  was  cmrectly 
identified  at  6.70  seconds,  then  the  sideslip  angle  sensor  was  identified  as  failed  at  8.20  seconds. 
So,  the  MMAE  probability  ended  up  with  filter  A4-S5,  which  is  the  desired  result.  It  is  important 
to  note  that  such  a  recovery  was  only  required  on  3  of  1960  runs,  this  is  less  than  a  0.2%  rate  of 
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false  fint  detecti<»i.  For  an  overview  of  MMAE  performance  with  the  sideilip  angle  sentor  failure 
at  the  first  of  two  failures,  see  Figures  F.19  and  F.20. 

All  dual  failures  except  one  were  correctly  identified  and  no  false  alarms  were  detected  with 
the  roll  rote  tensor  as  the  first  failed  component.  The  missed  failure  identification  was  that  of 
a  failed  right  ailercm  actuator  on  one  run.  There  was  also  one  run  that  switched  twice  between 
correct  and  partially  correct  declarations.  This  was  also  associated  with  the  right  aileron  actuator 
failure.  See  Figures  F.21  and  F.22. 

All  dual  failures  were  correctly  identified  with  the  roll  angjle  tensor  as  the  first  failure.  One 
false  alarm  was  detected  in  which  the  left  aileron  actuator  failure  was  identified  second  instead  of 
a  right  aileron  actuator  failure.  The  correct  failure  was  subsequently  identified.  See  Figures  F.23 
and  F.24. 

See  Figures  F.2S  and  F.26  for  MMAE  probabilities  when  the  yaw  rate  sensor  it  the  first  failure. 
One  false  alarm  was  detected  in  which  the  left  aileron  actuator  failure  was  identified  instead  of  a 
right  aileron  actuator  failure.  The  correct  actuator  was  not  subsequently  identified.  On  three  runs 
involving  the  sideslip  angle  sensor  as  the  second  failure,  the  MMAE  algorithm  did  not  make  any 
failure  declaration.  The  sideslip  angle  sensor  is  used  to  provide  feedback  to  the  fiight  control  system 
sideslip  angle  control  loop,  as  is  the  yaw  rate  sensor.  The  concliuions  to  be  seen  in  Section  5.2  that 
sensors  used  in  fiight  control  feedback  are  more  difficult  to  identify  because  of  the  unusual  residual 
characteristics  may  be  applied  here.  Indeed,  the  residuals  corresponding  to  the  sideslip  angle  sensor 
and  the  yaw  rate  sensor  develop  a  tighter  variance  in  the  fully  functional  filter  after  these  sensors 
aie  failed.  This  makes  it  more  difficult  to  shift  probability  from  the  fully  functional  filter  to  the 
correct  filter  which  develops  a  change  in  only  one  of  its  residuals. 

The  additional  failure  declarations  observed  may  be  attributed  the  aircraft  instability  caused 
by  the  failure  of  the  yaw  rate  sensor  (see  Section  5.1).  Therefore,  except  for  dual  failures  involving 
the  sideslip  angle  sensor.  Figures  F.25  or  F.26  show  good  MMAE  perfonnance  with  dual  failures 
which  include  the  yaw  rate  sensor. 

Conclusions  drawn  from  our  observation  of  MMAE  performance  against  dual  failures  are 
the  following.  The  hierardiical  structure  is  very  effective  in  identif3ring  two  failures  in  the  face  of 
wind  gust  uncertainty  and  sensor  noise  uncertainty.  The  hierarchical  structure  allows  the  MMAE 
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Figure  4.21  One  Run  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Sideslip  An^e  Sensor 
Failing  at  4.00  sec.  and  the  Right  Aileron  Actuator  Failing  at  5.00  sec.  Note  MMAE 
Recovery  from  False  First  Detection. 
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algorithm  to  identify  failures  out  of  the  order  in  which  they  are  induced.  No  time  is  wasted  in 
identifying  obvious  failures  while  ambiguity  might  exist  in  identifying  anothn  failure. 

The  several  missed  and  false  alarms  observed  were  associated  with  the  ailerons  in  which  left 
was  confused  with  right.  This  could  be  attributed  to  the  fact  that,  with  the  optimal  dither  used  in 
this  test  sequence,  the  ailerons  are  not  commanded  to  move  very  much.  Had  more  dynamic  range 
of  the  aileron  control  surfaces  been  utilised,  better  identification  of  left  and  right  aileron  actuator 
failures  would  have  resulted. 

There  were  three  isolated  incidents  of  the  MMAE  algorithm  making  false  first  failure  dec¬ 
larations.  This  caused  the  incorrect  level-1  filter  bank  to  be  brought  on-line.  Due  to  a  software 
problem,  subsequent  bank  switches  were  no  allowed.  However,  this  limitation  was  lifted  on  one 
simulation  to  illustrate  the  MMAE’s  ability  to  recover  from  a  false  failure  declaration  and  go  on  to 
make  the  correct  dual  failure  identification. 

4.5  Chapter  Summary 

The  results  of  extensive  testing  and  analysis  have  been  recorded  in  this  chapter  in  support 
of  the  objectives  presented  in  Section  1.5.  In  addition,  the  experience  of  tuning  the  elemental 
Kalman  filters  is  recorded.  The  toning  algorithm  of  Section  4.1  was  developed  out  of  necessity. 
A  complicated  wind  disturbance  model  made  it  difficult  to  tune  manually  the  sero-order  wind 
disturbances  accurately  enough  to  prevent  the  extremes  of  sluggish  or  volatile  MMAE  performance. 
The  automatic  tuning  algorithm  prove  to  be  quite  effective  in  maximizing  MMAE  performance. 

The  search  for  an  optimal  dither  technique  led  to  the  study  of  the  effects  of  varying  frequency 
and  magnitude  in  the  sinusoidal  command  input  dithers.  The  frequency  study  reveals  interesting 
relationships  between  failure  identification  times  and  Bode  magnitude  responses  in  the  identifi¬ 
cation  of  sensor  failures.  Sensors  involved  in  feedback  to  the  flight  control  system  have  different 
failure  identification  characteristics  as  dither  frequency  is  altered.  A  more  in-depth  study  of  this 
phenomenon  will  come  in  the  following  chapter.  The  knowledge  gained  in  the  study  of  vuious 
dither  frequencies  and  magnitudes  enabled  us  to  conclude  the  parameters  of  an  optimal  dither. 
This  dither  is  optimal  with  respect  to  failure  identification  time,  while  not  violating  constraints  on 
p-loading. 
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At  an  expl<ffatory  study,  command  inputs  derived  from  a  real  pilot’s  efforts  to  fly  the  airborne 
LAMBDA  were  used  to  command  the  computer  model  of  LAMBDA.  MMAE  failure  performance 
was  evaluated  with  the  pilot’s  inputs  acting  as  the  dither  routine.  The  need  for  out-of-phase  dithers 
on  the  left  and  right  control  channels  became  evident  when  attempting  to  identify  actuator  failures. 
However,  exceptionally  good  failure  identification  times  were  realised  with  the  aircraft  data  sensor 
failures. 

Finally,  dual  failure  performance  with  the  optimal  dither  was  studied.  Our  conclusion  is  that 
dual  failures  can  be  successfully  identified  with  the  MMAE  algorithm  and  a  hierarchical  filter  bank 
structure.  Though  failures  were  not  always  identified  in  the  order  of  their  introduction,  the  correct 
dual  failure  hypothesis  was  consistently  declared.  Also,  one  incident  of  the  MMAE’s  ability  to 
recover  from  a  false  alarm  was  illustrated. 
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V.  Secondary  Analyses 


Chapter  IV  provided  an  extensive  discussion  of  the  primary  objective  of  this  thesis.  In  the 
present  chapter,  many  secondary  issues  brought  up  in  Chi^ter  IV  will  be  studied.  These  topics 
include  the  effect  of  a  failed  yaw  rate  sensor  on  the  stability  of  the  aircraft,  an  in-depth  look  at 
MMAE  performance  in  the  face  of  failures  of  feedback  sensors,  and  finally,  a  study  of  MMAE 
response  to  phugoid  frequency  dithers  at  very  low  magnitude. 

5.1  Failure  of  Yaw  Rate  Sensor 

The  failure  of  any  single  component  used  in  our  failure  simulations  wiU  result  in  a  controllable 
aircraft  except  for  the  yaw  rate  sensor  failure,  S8.  Refer  to  Figure  5.1.  On  all  MMAE  filter 
probability  plots  involving  a  yaw  rate  sensor  failure,  the  probability  will  rise  through  its  transient 
response  and  remain  at  a  level  which  correctly  identifies  the  yaw  rate  sensor  as  failed.  After  a  few 
seconds  though,  the  probability  drops  from  a  solid  identification  and  deteriorates  as  time  goes  on. 
This  is  not  due  to  a  faulty  characteristic  of  the  MMAE  algorithm.  Rather,  this  happens  because 
the  aircraft  itself  is  going  unstable. 

When  the  yaw  rate  sensor  is  disabled,  the  flight  control  system  (Figure  3.1)  loses  its  input 
to  the  washout  filter  which  is  a  compensator  in  the  feedback  loop.  The  stability  of  the  lateral 
system  is  therefore  compromised.  Dissection  shows  that  the  discrete-time  state  transition  matrix 
for  the  augmented  truth  model  with  a  yaw  rate  sensor  failure  has  an  eigenvalue  which  lies  outside 
of  the  unit  circle.  The  purpose  of  this  thesis  is  not  to  stabilise  the  aircraft  under  such  conditions 
as  the  aircraft  wotild  go  unstable  whether  an  MMAE  system  were  in  place  or  not.  The  point  is 
that  the  MMAE  algorithm  correctly  identifies  the  failure  well  in  advance  of  the  aircraft  becoming 
imcontrollable.  The  flight  control  system  designer  is  left  with  the  task  of  reconfiguring  the  flight 
control  system  once  he/she  has  been  warned  about  this  failed  condition. 

The  reader  is  therefore  warned  that  the  filter  probability  for  the  failed  yaw  rate  sensor  filter 
will  always  drop  off  after  having  shown  a  solid  identification.  Know  that  the  cause  is  due  to  the 
augmented  aircraft’s  instability,  not  the  MMAE’s  deficiency. 
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induced  taiiure  in  S8  at  4.00  s. 
Average  of  10  Monte  Carlo  mns. 
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S.t  Failure  of  Feedback  Setuore 

A  trend  is  detected  concerning  the  relative  identification  time  of  sensors  used  for  PCS  feedback 
compared  with  those  not  integrated  into  the  PCS.  That  is,  in  the  longitudinal  channel,  we  see  that 
failures  associated  with  the  pitch  rate  sensor  take  longer  to  identify  than  failures  of  the  forward 
velocity,  angle  of  attack,  and  pitch  angle  sensors.  In  the  lateral  directional  channel,  this  trend  is 
seen  in  the  sideslip  angle  sensor,  yaw  rate  sensor,  and  roll  rate  sensor  failures  having  a  tendency 
to  lag  in  their  identification  times  behind  that  of  the  roll  angle  sensor.  One  mi{^t  e^ect  that  this 
angle  sensor  would  lag  behind  the  other  rate  sensors  because  it  is  the  integral  of  a  rate  aircraft 
state  variable.  The  intent  of  the  following  investigation  is  to  modify  our  beliefs  about  residual 
monitoring  on  sensor  failures  when  the  sensor  provides  feedback  to  the  PCS. 

To  establish  a  baseline  for  discussion,  Pigure  5.2  is  presented  to  show  the  residuals  of  the  fully 
functional  aircraft  filter  that  is  given  measurements  and  control  inputs  from  a  truth  model  that 
represents  a  fully  functional  aircraft. 

Pigure  5.3  shows  the  classical  response  of  a  Kalman  filter’s  residuals  to  a  sensor  failure. 
Residuals  from  the  filter  hypothesising  a  fully  frmctional  aircraft  are  plotted  verstis  time.  At  4.00 
seconds,  the  pitch  angle  sensor  failure  is  induced  and  the  effect  is  clearly  seen  in  the  pitch  angle 
residual,  theta.  A  severe  discontinuity  of  the  character  described  in  Subsection  1.3.4  is  evident.  No 
significant  effect  can  be  detected  in  any  other  sensor  residual  except  perhaps  that  of  the  forward 
velocity  sensor.  The  trace  of  u  appears  to  oscillate  after  4.00  seconds  but  it  is  exactly  the  same  as 
it  would  be  with  no  failure  induced.  Refer  to  Pigure  5.2.  So,  the  induced  sensor  failure  results  is 
exru:tly  what  one  would  expect;  a  jump  discontinuity  followed  by  osciUations  in  the  residual  of  the 
failed  sensor  with  no  change  in  any  other  residuals. 

The  filter  hypothesizing  the  pitch  angle  sensor  failure  produces  the  residuals  in  Pigure  5.4 
when  receiving  measurements  and  actuator  command  inputs  (see  Pigure  5.6)  identical  to  those 
processed  by  the  fiiUy  frmctional  filter  of  Pigure  5.3.  The  pitch  angle  residual  of  Pigure  5.4  clearly 
shows  a  change  to  zero-mean  while  the  other  residuals  remain  unchanged.  Pigure  5.5  shows  the 
dithers  applied  to  the  flight  control  system  of  Pigure  3.1.  These  plots  can  be  used  to  pick  out 
dither  oscillations  in  residuals.  When  the  h3rpothesis  of  the  filter  matches  the  condition  of  the  truth 
model,  residuals  look  white  and  zero-mean;  when  the  hypothesis  does  not  match,  residuals  display 
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Figure  5.2  Lonptudinal  Residuals  of  Fully  factional  Filter  Acting  on  FuUy  Functional  Aircraft. 

Pitch  Command  Dither  Has  Amplitude  ±4  deg/sec  and  Frequency  6.6611  rad/sec. 

dither  oscillations  because  they  are  not  compensated  correctly  by  the  filter.  This  is  easily  seen  in 
the  the  plot  of  the  theta  residual  in  Figure  5.3.  The  aircraft  sensors  give  the  outputs  shown  in 
Figure  5.6  when  the  pitch  angle  sensor  is  failed  at  4.00  seconds.  Note  that  the  aircraft  continues 
along  its  flight  path  with  no  change  in  trajectory  despite  this  sensor  failure.  The  dash-dot  lines  of 
the  bottom  two  plots  represent  the  limits  imposed  on  the  elevator  surface  deflection. 

Now  consider  the  failure  of  the  pitch  rate  sensor.  This  situation  is  different  because  the  pitch 
rate  sensor  provides  feedback  to  the  flight  control  system  which  is  responding  to  a  commanded 
pitch  rate  (see  Figure  3.1).  Conversely,  the  pitch  angle  sensor  is  not  incorporated  into  the  FCS. 
The  residuals  produced  by  the  Alter  holding  the  fully  functional  hypothesis  are  shown  in  Figure  5.7 
with  the  introduction  of  a  pitch  rate  sensor  failure  at  4.00  seconds.  Even  though  this  is  a  sensor 
failure,  there  is  no  jump  discontinuity  in  the  q  residual.  In  fact,  we  see  that  the  residuals  of  the 
failed  sensor  on  the  fully  functional  Alter  get  better  than  they  were  before  the  failure.  Moreover, 
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Figure  5.3  Longitudinal  Residuak  of  FuUy  Functional  Filter  Acting  on  Pitdi  Angle  Sensor  Failure 
Which  Occurs  at  4.00  sec.  Pitch  Command  Dither  Has  Amplitude  ±4  deg/sec  and 
fVequency  6.6611  rad/sec. 

distinct  changes  occur  in  the  pitch  angle  sensor  residuals,  theta,  and  the  angle  of  attack  sensor 
residuals,  alpha.  Three  questions  come  to  mind:  Why  do  the  failed  sensor  residuals  get  better  on 
the  filter  with  the  wrong  hypothesis?  Why  are  other  residuals  affected?  And,  why  does  the  MMAE 
algorithm  still  make  the  correct  failure  identification,  regardless? 

The  answer  to  the  last  question  is  found  in  a  study  of  the  failed  pitch  rate  sensor  filter’s 
residuals  shown  in  Figure  5.8.  Here,  observations  similar  to  those  made  of  Figure  5.4  for  the 
correct  filter  responding  to  a  non-feedback  sensor  failure  are  made.  The  residuals  of  q,  the  failed 
pitch  rate  sensor,  develop  zero  mean  and  small  magnitude  characteristics  while  the  other  residuals 
seem  to  be  affected  to  a  much  smaller  degree. 

So,  the  conclusion  is  that  the  MMAE  is  able  to  identify  the  failed  pitch  rate  sensor  correctly 
because  (a)  residuals  of  sensors  other  than  those  of  the  failed  sensor  get  large  on  the  fully  functional 
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Rtter  S4  action  on  failure  of  S4  at  4.00  sec. 
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Figure  5.4  Longitudinal  Residuals  of  Fkiled  Pitch  Angle  Sensor  Filter  Acting  on  Pitch  Angle 
Sensor  Failure  Which  Occurs  at  4.00  sec.  Pitch  Command  Dither  Has  Amplitude  ±4 
deg/sec  and  frequency  6.6611  rad/sec. 

filter  and  (b)  the  characteristic  sensor  failure  response  of  a  sero  mean  and  reduced  magnitude 
residual  is  evident  on  the  failed  sensor  filter.  Our  original  question  of  why  does  the  pitch  rate 
sensor  take  more  time  to  identify  than  all  other  longitudinal  sensors  can  be  answered  with  the 
foUowing  explanation.  Instead  of  watching  for  an  increase  in  one  residual  on  the  fuUy  functional 
filter  and  a  decrease  in  the  respective  residual  on  the  failed  sensor  filter,  the  MMAE  nmst  overcome 
the  decrease  in  the  failed  sensor  residual  on  the  fuUy  fimctional  filter  by  waiting  for  other  residuals 
on  that  filter  to  get  large.  The  correct  filter,  as  before,  only  shows  a  decrease  in  the  residual  of 
its  h3rpothesised  sensor  failure.  Its  resulting  change  in  probability  is  not  large  enough  to  compete 
with  the  complex  changes  in  the  fully  fimctional  filter.  So,  it  seems  that  the  MMAB’s  identification 
strategy  is  to  wait  for  th?  mcorrect  filters  to  diverge  rather  than  make  a  quick  identification  of  the 
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Figure  5.5  Pitch  Command  Dither  [degrees/aecond]  with  Aiiq>litude  ±4  deg/iec  and  Frequency 
6.6611  rad/sec.  Bight  If  195*  Out  of  Phiue  With  Left. 

correct  filter.  The  length  of  time  taken  by  the  incorrect  filters  to  direrge  is  dictated  by  the  sise  of 
the  T^Al^Tk  in  each  of  the  elemental  filters. 

To  be  sure,  the  hjrpothesis  of  a  failed  pitch  angle  sensor  suggested  by  the  residual  theta  in 
Figure  5.7  is  not  believed  by  the  MMAE  because  the  residuals  for  the  filter  of  this  h3rpothesia  get 
large,  as  seen  in  Figure  5.10,  just  as  those  of  the  fully  functional  filter. 

With  the  primary  questions  answered,  a  short  explanation  is  given  of  why  the  other  residuals 
ate  affected  and  why  they  get  so  large  on  the  fully  functional  filter.  Since  the  FCS  contrcds  pitch 
rate  by  adding  a  pitch  rate  feedback  signal  to  pitch  conomand  to  form  an  error  signal,  elevator 
coordination  with  pitch  command  is  lost  if  the  sensor  measurements  loose  all  correlation  with  the 
true  aircraft  pitch  rate  state.  As  an  aside,  this  situation  could  be  improved  by  running  MMAE- 
estimated  pitch  rate  into  the  FCS  instead  of  the  output  of  the  failed  pitch  rate  sensor. 

The  correlation  of  elevator  actuator  commands  to  pitch  rate  before  the  sensor  failure  is  il¬ 
lustrated  in  Figure  5.10  by  looking  at  q,  Lt  Elev,  and  Rt  Elev  at  around  the  2.00  second  mark.  A 
sharp  increase  then  decrease  is  seen  in  q  and  the  resulting  command  to  the  elevators  can  be  seen 
to  have  a  similar  transition.  After  4.00  seconds  though,  the  Lt  Elev  and  Rt  Elev  plots  seem  to 
loose  some  firequency  content  that  was  present  before.  This  is  attributed  to  the  loss  of  pitch  rate 
information  in  the  development  of  elevator  actuator  commands.  As  a  result,  the  commands  applied 
to  the  elevator  actuators  will  not  control  pitch  rate  as  desired.  In  this  condition,  the  aircraft  no 
longer  has  the  desired  response  of  remaining  on  the  original  trajectory.  The  significant  effects  are 
seen  in  Figure  5.10  as  the  drop  off  of  velocity,  u,  the  increase  in  pitch  angle,  theta,  and  the  erratic 
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bdunrior  of  aa^  of  attack,  a^ha.  The  plot  of  q  ia  the  leiisor  meoraKment  of  pitdi  rate:  the  lutdi 
rate  atete  ii  not  shown  in  Figure  5.10.  For  cooqMoison,  the  aircraft  pitch  rate  state  is  shown  alone 
in  Figure  6.11  to  Tcrify  the  intnitiTe  conclusion  that  this  state  must  derek^  a  bias  (since  theta 
ramps)  and  exhibit  an  uncontrolled  bchaTior. 

Now  consider  that  residuals  are  the  difference  between  actual  measurement  and  filter*predicted 
measurement.  If  the  sensors  are  registering  such  huge  displacements  frmn  the  nominal,  the  fully 
functional  filter  will  indeed  track  them  but  the  residual  magnitudes  will  be  large  as  compared  to 
filter  tracking  sensor  measurements  closer  to  the  nominal.  This  is  the  effect  seen  in  Figure  5.7, 
which  was  discussed  above. 

In  summary,  our  presumptimis  about  residual  monitoring  for  sensor  failures  must  be  modified 
to  account  for  the  effect  of  failed  senscws  providing  feedback  to  control  the  aircraft .  The  discontinuity 
in  the  failed  sensor  residual  will  not  be  present  in  the  fully  functional  filter,  but  it  will  be  present 
in  the  filter  with  the  failed  sensor  hypothesis.  Also,  longer  identification  tiinp«  can  be  expected  for 
such  sensor  fSsilures  due  to  the  onnplex  reactions  of  the  fully  functional  filter. 
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Figuie  5.6  Longitudinal  Flight  Data  Seniort  Eesponding  to  Pitch  Angle  Sensor  Esihire  Occnrring 
at  4.00  sec.  FCS  Commands  to  Actuators  Are  Shown  in  Bottom  Two  Plots.  Pitch 
ounmand  dither  has  amplitude  ±4  d^/sec  and  frequency  6.6611  rad/sec. 
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Finer  FF  acdon  on  taUum  of  S3  at  4.00  sec. 
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Figure  5.7  Longitudinal  Residuals  of  FUlly  F^uctional  Filter  Acting  on  Pitch  Rate  Sauor  Fsilnre 
Which  Occurs  at  4.00  sec.  Pitch  Command  Dither  Has  Anqplitude  ±4  deg/sec  and 
Frequency  6.6611  rad/sec. 
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Figure  5.9  Longitudinal  Residuals  of  Failed  Pitdi  Angle  Sensor  Filter  Acting  oa  Pitch  Rate  Sensor 
Failure  Which  Occurs  at  4.00  sec.  Pitch  Command  Dither  Has  Amplitude  ±4  deg/sec 
and  Frequency  6.6611  rad/sec. 
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Figure  5.10  Longitudinal  Flight  Data  Sensors  Responding  to  Pitch  Rate  Sensor  Fhilure  Occurring 
at  4.00  sec.  Flight  Control  System  Commands  to  Actuators  are  Shown  in  Bottom 
Two  Plots.  Pitch  Command  Dither  Has  Amplitude  ±4  deg/sec  and  Frequency  6.6611 
rad/sec. 


Figure  5.11  Aircraft  Pitch  Rate  State  Resulting  from  Failed  Pitdi  Rate  Sensor  Failure  Occurring 
at  4.00  sec.  Pitch  Command  Dither  Has  Amplitude  ±4  deg/sec  and  Frequency  6.6611 
rad/sec. 


5-13 


5.3  Dithering  at  the  Phagoii  Freqaencg  and  Low  liagnitnde 

The  problems  of  short  simulation  duration  caused  the  very  low  frequency  trials  to  be  all 
but  discarded  when  plotting  the  fidlure  identification  times  vs  acceleration  for  the  various  test 
frequencies.  Also,  because  of  the  large  magnitude  on  the  dither  sinusoids,  the  elevator  control 
surfaces  were  conomanded  out  of  their  limits.  To  perform  a  partial  investigation  of  what  was 
missing,  a  very  low  magnitude  dither  at  the  phugoid  frequency  (a;  =  0.2484)  was  used  for  a  set  of 
test  runs.  Dither  signals  implied  to  the  command  input  are  represented  by  Equation  (5.1): 


Right  pitch  rate  command 
Left  pitch  rate  command 
Right  roU  rate  command 
Left  roll  rate  command 
Right  sideslip  angle  command 
Left  sideslip  angle  command 


0.3  X  sin(0.2484t  +  deg/sec 
0.3  X  sin(0.2484t  +  ^,i)  deg/sec 
1.0  X  sin(0.2484t  -{-  deg/sec 
1.0  X  sin(0.2484t  +  ^,1)  deg/sec 
1.0  X  sin(0.2484t  -f  ^)  deg 
1.0  X  sin(0.2484t  +  ^1)  deg 


(5.1) 


The  resulting  failure  identification  times  are  significant  reductions  from  those  of  our  optimal  dither 
in  Figure  4.15.  See  Figure  5.12.  The  pitch  rate  magnitude  of  0.3  deg/sec  causes  the  elevators  to 
move  through  63%  of  their  ±15**  range  with  the  left  elevator  nearly  breaking  the  upper  limit  and 
the  right  elevator  nearly  breaking  the  lower  limit.  The  ailerons  and  rudders  utilise  less  than  20% 
of  their  ranges  when  commanded  with  the  dither  signals  given  in  Equation  (5.1).  Note,  however, 
firom  Table  5.1  that  the  p-limits  have  not  been  broken,  as  is  the  case  with  the  IMals  of  Section  4.2 
in  which  low  frequencies  cause  severe  p-limit  violations. 


Table  5.1  Lateral  and  Vertical  Acceleration  Statistics  Resulting  from  One  Complete  Cycle  of 
Phugoid  Frequency  Dither. 


Component 

Einsn 

A.  [G’s] 

Maximum  Occurrence 

+2<r 

0.1359 

mean 

-l<r 

— 2<r 

Minimum  Occurrence 

-0.7328 
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Figure  5.12  MMAE  Filter  Probability  Histories  when  Dithering  at  Phngoid  frequency. 
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Figuie  5.13  thows  the  flight  control  tyitem  conunand  inputs  and  the  p-loading  resulting 
from  those  inputs.  The  ordinate  labels  are  defined  as  follows:  Ecmd  Rt  -  right  channd  pitch  rate 
command;  Ecmd  Lt  -  left  channel  pitch  rate  command;  avg  Az  -  average  vertical  acceleration  from 
10  Monte  Carlo  runs;  Acmd  Rt  -  right  channel  roll  rate  command;  Acmd  Lt  -  left  channel  roll  rate 
command;  Rcmd  Rt  -  right  channel  sideslip  angle  command;  Rcmd  Lt  -  left  channel  sideslip  angle 
command;  and  avg  Ay  -  average  horisontal  acceleration  from  10  Monte  Carlo  runs. 

For  the  fully  functional  aircraft,  there  were  no  false  alarms  in  ten  Monte  Carlo  runs  of  12 
seconds  duration  each.  There  were  false  alarms  when  testing  the  MMAE  against  right  and  left 
elevators.  On  Run  4  with  the  induction  of  a  right  elevator  actuator  failure  at  4.00  seconds,  the 
correct  filter  was  identified  at  4.22  seconds.  5.60  seconds  later,  the  left  elevator  was  identified  but 
probability  subsequently  returned  to  the  correct  filter.  Similarly,  three  runs  with  a  left  elevator 
actuator  failure  induced,  produced  false  alarms  for  angle  of  attack  sensor  and  right  elevator  actuator 
failures.  There  is  no  consistent  pattern  and,  of  140  separate  runs,  there  were  only  these  four  false 
alarms.  This  neglects  the  aircraft  instability  and  false  alarms  caused  by  a  failed  yaw  rate  sensor  as 
seen  in  the  probability  plot  of  filter  S8  in  Figure  5.12. 

The  false  alarm  of  the  left  elevator  on  Run  4  was  investigated  in-depth.  No  explanation  could 
be  found  for  this  false  alarm.  The  filter  residuals  for  the  correct  filter  were  zero-mean  Gaussian,  as 
expected,  and  the  residuals  for  the  falsely  declared  filter  were  well  outside  their  ±2er  bounds.  The 
only  deviation  from  a  normal  run  is  that  the  remaining  operational  elevator  is  commanded  to  deflect 
8°  outside  of  its  travel  limits  of  ^IS**.  The  limit  is  broken  at  7.26  seconds  and  rises  smoothly  to  a 
maximum  of  128%  of  the  elevator  deflection  range.  The  limit  is  broken  well  after  the  first  correct 
failure  is  declared  but  before  the  false  second  failure  is  declared.  The  phase  relationship  between 
the  two  elevator  control  surfaces  is  lost  when  one  surface  fails.  This  gives  the  remaining  surface 
complete  authority  over  the  controlled  aircraft  state,  pitch  rate.  Why  the  remaining  elevator  is 
commanded  to  defiect  even  more  than  when  it  was  competing  with  opposing  commands  to  the 
other  elevator  is  a  mystery.  Our  investigations  reveal  no  explanations.  However,  this  event  does 
add  credibility  to  the  idea  that  a  different  dithers  should  be  employed  when  the  aircraft  already 
has  one  failed  component.  Dithers  for  the  fully  functional  aircraft  were  designed  with  all  control 
surfaces  and  sensors  intact.  It  therefore  follows  to  reason  that  dithers  for  partially  disabled  aircraft 
should  be  designed  according  to  the  available  fiight  control  components. 
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Cmd  Inputs  ^togrees/sec]  and  G-fbrcea  b's] 


No  failures  induced. 


Figure  5.13  Command  Inputs  and  Resulting  Vertical  and  Horisontal  Accelerations  when  Dithering 
at  Phugoid  Frequency. 
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Referring  to  Figure  5.13,  we  can  see  the  unnenal  effect  of  dithering  at  the  phngoid  frequency. 
The  vertical  y-load  has  the  high  frequency  content  associated  with  wind  gusting  but  it  also  has 
the  low  frequency  component  of  the  phugoid.  The  range  of  vertical  acceleration  samples  does  not 
exceed  the  limit  of  0.1  g.  It  is  important  to  note  that  a  full  cycle  of  command  input  is  complete 
at  the  end  of  the  simulation,  which  runs  for  25.30  seconds  Other  simulations  in  this  thesis  stop  at 
12.02  seconds.  Even  though  the  statistics  only  represent  one  cycle,  they  are  more  representative  of 
the  true  effect  than  statistics  from  a  partial  cycle. 

With  the  exception  of  the  lateral  control  surface  actuator  failures  and  the  angle  of  attack 
sensor  failure,  better  MMAE  performance  was  obtained  with  the  shorter  frequency  dithers  of 
Equation  (4.6).  Therefore,  in  light  of  the  false  alarms  and  small  improvement  in  some  failure 
identification  times,  we  are  more  inclined  to  view  the  optimal  dither  of  Figure  4.15  as  the  best 
dither  possible  within  the  scope  of  our  work. 

5.4  Chapter  Summary 

There  were  observations  made  in  Chapter  IV  which  have  merited  further  study  to  provide 
credible  substance  to  the  explanations  given  concerning  the  primary  research  objectives.  The  first  is 
unusual  MMAE  performance  resulting  from  a  failed  yaw  rate  sensor.  A  separate  analysis  concludes 
that  no  problem  exists  with  the  MMAE  algorithm  in  this  particular  situation,  but  that  a  failed 
yaw  rate  sensor  causes  the  aircraft  to  go  unstable  in  the  lateral  channel.  This  explanation  must  be 
kept  in  mind  wherever  yaw  rate  sensor  failures  are  induced. 

Sensors  providing  a  feedback  signal  to  the  flight  control  system  seemed  to  take  longer  to 
identify  than  sensors  that  do  not  provide  feedback.  One  might  suppose  that,  since  the  failure  of 
these  sensors  has  an  effect  on  all  aircraft  states,  they  might  have  quicker  failure  identification  times. 
The  converse  is  true,  and  the  detailed  analysis  in  this  chapter  revealed  that  the  residual  of  the  failed 
sensor  in  the  fully  functional  filter  actually  has  a  decrease  in  variance  once  a  failure  is  induced. 
The  MMAE  must  wait  for  all  of  the  other  residuals  to  deviate  from  zero-mean  before  it  is  able  to 
declare  the  correct  failure. 

Finally,  the  problem  of  elevator  control  surfaces  breaking  their  travel  limits  when  dithered 
at  low  frequencies  is  corrected.  The  phugoid  frequency  is  chosen  as  the  dither  frequency  and  the 
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dither  magnitudes  are  a4iusted  so  that  the  travel  hmits  are  not  broken.  With  this  c<»Tccti<ni, 
MMAE  performance  is  re-evaluated  against  low  frequency  dithers.  Some  improvement  was  gained 
in  failure  identification  times,  although  an  exceptionally  long  time  was  taken  to  identify  a  failed 
sideslip  angle  sensor,  which  is  not  surprising  since  this  sensor  has  a  great  deal  of  additive  noise  in 
its  output. 
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VI.  Conchuions  and  Recommendationa 


Our  invettigation  of  the  MMA£  algcmthm  has  revealed  several  interesting  characteristics 
about  the  nature  of  MMAE  and  its  application  to  a  dynamic  system  with  rather  significant  random 
inputs.  This  chapter  will  review  the  findinga  of  the  research  with  respect  to  the  initial  objectives, 
summarise  the  conclusions  drawn  from  the  Kalman  filter  tuning  experience,  and  present  a  sug^ted 
course  of  action  to  implement  MMAR  on-board  tlw  real  LAMBDA.  Finally,  topics  for  further 
research  are  presented. 

6.1  Summary  of  Findinga 

A  review  of  the  research  objectives  established  in  Section  1.5  is  now  presented  along  with  a 
review  of  the  actual  findings. 

What  ia  the  form  of  the  dither  input  that  cauaea  the  guickeat  convergence  of  the  MhiAB 
algorithm  to  a  correct  failure  hypotheaia? 

It  appears  that  the  sinusoidal  signal  possesses  the  best  characteristics  for  dithering  a  system 
to  enhance  MMAE  failure  identification.  The  first  reason  is  that  the  sinusoid  has  a  constantly 
rbanging  first  derivative.  This  hau  advantages  above  the  square  wave  and  triangle  wave  in  that 
the  system  is  constantly  being  excited  rather  than  just  relying  on  the  transients  of  the  system  for 
excitation.  Secondly,  the  excitation  may  be  confined  to  a  single  frequency  rather  than  a  band.  A 
square  wave  produces  system  excitation  that  has  the  frequency  components  of  the  period  between 
pulses,  the  duration  of  the  pulse,  and  the  natural  frequency  of  the  system,  as  well  as  high  frequency 
content  due  to  the  sharp  change.  With  the  sintuoid,  we  have  shown  that  failure  identification  times 
may  be  correlated  with  the  frequency  of  dither.  Thus,  there  is  no  need  to  add  in  several  different 
frequencies  to  enhance  MMAE  failure  identification.  However,  if  a  combination  of  frequencies  is 
found  to  be  useful  in  failure  identification,  some  linear  combination  of  sinusoids  could  be  designed 
so  that  all  frequency  components  could  be  controlled. 

What  magnitude  of  lateral  and  vertical  g-forces  voould  be  considered  to  be  “aubliminal"  to  the 
aircrew? 

Our  research  in  determining  the  limits  of  “subliminal”  p-loading  was  restricted  to  the  findings 
in  published  literature  and  personal  interviews  with  authorities  on  human  factors  engineering.  The 
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limit  of  0.10  y’s  in  the  vertical  direction  and  0.20  g’n  in  the  horisontal  direction  waa  based  mainly 
on  Menke’s  statement  [15]  and  supported  by  various  other  sources  mentioned  in  Subsection  3.4.2. 

V^hat  ts  the  best  balance  between  subUminaUty  and  faUnre  identification  Ume? 

The  plots  of  acceleration  versus  MMAE  failure  identification  time  in  Secticm  4.2  goierally 
have  a  breaking  point  where  the  accelerations  become  very  large  for  very  little  improvement  in 
failure  identification  time.  We  note  that  the  issues  to  balance  are  really  failure  identification 
time  and  aircraft  state  excitation  rather  than  applied  p-forces.  Accelerations  in  the  vertical  and 
horisontal  directions  are  derived  from  state  excitation.  Also,  failure  identification  times  for  control 
surfaces  depend  on  control  surface  deflections  which,  with  the  QFT  flight  control  system,  is  a 
function  of  offset  between  right  and  left  control  input  channels.  As  discussed  in  Subsection  4.2.1, 
the  relationship  between  applied  p-forces  and  failure  identification  time  is  different  from  failed 
component  to  failed  component.  Therefore,  a  compromise  must  be  made  in  defining  the  optimal 
dither  for  all  component  failure  identifications. 

What  format  of  dither  input  will  provide  the  best  overall  performance  m  terms  of  failure 
protection,  aircrew  convenience,  and  comfort? 

In  terms  of  best  overall  MMAE  performance,  the  optimal  dither  of  Equation  (4.6)  provides 
the  best  protection  for  all  failed  component  identifications  if  only  constant  magnitude,  frequency, 
and  phase  are  used.  In  terms  of  aircrew  comfort,  this  optimal  dither  also  limits  aircraft  p-loads 
to  less  than  the  established  limits  for  this  thesis.  However,  considering  that  the  LAMBDA  is 
an  unmanned,  remotely  piloted  vehicle,  the  limit  of  p-forces  simply  demonstrates  that  they  can 
be  limited,  as  is  desired  for  manned  aircraft,  while  providing  good  MMAE  failure  identification 
performance.  The  question  of  convenience  was  not  addressed  for  the  lack  of  immediate  resources 
and  lack  of  concern  with  respect  to  the  unmanned  LAMBDA. 

Does  the  MMAE  hierarchical-structured  failure  detection  algorithm  converge  to  the  correct 
dual  failure  hypothesis? 

The  hierarchical  structure  performs  well  when  the  aircraft  system  is  controlled  with  our 
optimal  dither  of  Ek^uation  (4.6).  Althotigh  there  were  a  few  false  alarms,  there  was  no  pattern  of 
consistent  false  alarms  or  missed  alarms. 
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Does  the  algarWum  converge  to  Ae  correct  dual  faihtre  kgfoAeeie  qviddg  enovgk  to  frevent 
incorrect  fdihre  kgpotkesee  dedaratUme  or  eeverdg  degraded  control  of  tke  aircraftf 

A  fortunate  example  available  to  illtutrate  that  a  iailnie  can  be  identified  hefim  the  aircraft 
goes  out  of  control  is  that  of  the  yaw  rate  sensor  failure.  The  problems  of  aircraft  stability  associated 
with  this  failure  are  discussed  in  Section  5.1.  It  is  proven  that  a  yaw  rate  sensor  failure  can  be 
identified  by  the  MMAE  within  one  seccmd  and  the  aircraft  will  remain  stable  for  up  to  4  seconds 
after  the  failure.  This  allows  3  seconds  for  fii^t  control  system  re-configuration  which,  in  this 
case,  may  simply  be  to  null  the  fiight  control  systems’  commands  to  the  rudder  control  surfaces. 
We  have  also  proven  that  two  failures  spaced  in  time  by  1  seccmd  are  identified  correctly  with  the 
MMAE  hierarchical  structure. 

Is  tke  algorithm’s  performance  path-dependent  for  the  identification  of  simvUaneous  dual  failr 

uresf 

Simultaneous  dual  failures  were  not  tested.  However,  it  is  noted  that  the  order  of  failures 
does  impact  the  time  to  identify  them. 

The  dMculties  encountered  while  tuning  the  elemental  Kalman  filters  led  to  the  development 
of  a  computer  algorithm  to  accomplish  this  task.  The  objective  is  to  allow  for  unknown  wind 
perturbations  of  state  variables  while  keeping  elemental  Kabnan  filters  tightly  tuned.  This  was 
accomplished  by  tuning  against  a  portion  of  the  simulated  vrind  conditions  against  which  the 
MMAE-augmented  LAMBDA  model  is  fiown.  The  strategy  is  to  reduce  the  entire  Q  matrix 
incrementally  so  that  MMAE  probability  of  fully  functional  filter  does  not  drop  below  2%  of  its 
maximum  value  during  60  seconds  of  simulaticn. 

A  peculiarity  of  using  MMAE  on  a  system  augmented  with  a  control  system  was  found.  The 
left  and  right  fiight  control  systems,  when  subjected  to  out-of-phase  dithers,  attempt  to  compensate 
for  the  unrealised  change  in  a  single  controlled  aircraft  state  by  increasing  the  defiection  of  their  re¬ 
spective  control  surface.  Even  though  the  fiight  control  system  input  magnitudes  are  kept  the  same, 
there  was  a  big  difference  between  the  amount  of  control  surface  defiection  that  was  commanded 
for  different  frequencies.  So,  the  effect  is  that  as  dither  frequency  varied,  so  did  the  magnitude  of 
aircraft  state  excitation  which,  we  know,  also  plays  a  predictable  roll  in  failure  identification  time. 
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Ail  optimal  ditlier  nmtine  was  ikdoced  by  testing  the  tiwio  to  identify  all  types  of  single  failures 
against  different  frctpiendes  and  magnitudes  of  input  dither.  The  first  task  was  to  alter  frequency 
while  input  dither  magnitude  remained  constant.  Actuator  failures  are  best  identified  with  higher 
frequency  dithers  at  about  the  3  rad/sec.  Sensor  failures  hare  a  dither  fitcquency  relationship 
with  failure  identificati<»i  time  that  can  be  predicted  by  looking  at  the  Bode  plot  resp<«ise  of  the 
cturesponding  aircraft  state  to  the  dithering  control  surface.  That  is,  for  dither  frequencies  in 
the  high-gain  region  of  the  Log-magnitude  plot,  one  can  expect  quick  failure  identification  times. 
However,  if  a  sensor  is  included  in  the  feedback  loop  eff  the  fiight  control  system,  the  time  to  identify 
the  failure  of  that  sensor  does  not  correlate  with  the  Log-magnitude  Bode  plot.  A  study  of  this 
phenomenon  was  accomplished  and  the  findings  are  that  the  scalar  residual  behavior  exhibited  by  a 
non-feedback  sensor  is  not  characteristic  of  that  of  a  feedback  sensor.  Rather,  as  with  control  surface 
failures,  more  than  one  residual  of  the  fully  functional  filter  will  begin  to  deviate.  In  addition,  the 
scalar  residual  of  the  failed  sensor  may  have  a  reduced  variation  in  the  fully  functional  filter.  The 
impact  is  that  scalar  residual  monitoring  must  be  accomplished  in  the  filter  which  hypothesises  the 
failure  of  the  sensor. 

An  optimal  dither  format  was  developed  based  on  a  balance  of  best  frequency  and  magnitude 
of  dither  for  each  type  of  failure  in  each  channel.  Rudder  and  aileron  dithers  were  synchronised  in 
frequency  to  simplify  analysis,  but  there  is  the  possibility  that  using  separate  dither  characteristics 
for  these  control  surfaces  will  yield  better  failure  identification  by  taking  advantage  of  the  sideslip 
angle  and  yaw  rate  response  to  low  frequency. 

A  sample  of  the  LAMBDA’S  pilot  control  stick  inputs  was  obtained  and  applied  to  the  inputs 
of  our  truth  model.  The  intent  was  to  see  what  MMAE  performance  would  be  if  no  automatic 
dither  is  applied  and  the  only  fiight  control  system  inputs  are  those  of  the  pilot  in  his/her  effort  to 
maintain  a  straight  and  level  fiight  path.  In  this  study,  there  was  no  phase  difference  between  left 
and  right  channel  control  inputs.  Under  that  condition ,  the  MMAE  was  unable  to  distinguish  a  left 
actuator  from  a  right  actuator  failure  effectively.  However,  sensor  failures  were  identified  quickly. 
Of  note  is  that  the  pilot’s  commands  resulted  in  p-loading  outside  of  our  established  limits. 
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6.i  Siigge$tum$  for  Imflemeniing  an  Effeetne  MUAB  om  LAMBDA 


The  optimal  dither  routine  hai  been  ettabluhed  fat  the  flight  conditions  simulated  in  the 
software  designed  with  the  uncertainty  characteristics  specified  by  the  Dryden  Wind  Gust  Model. 
MMAE  performance  varied  greatly  according  to  how  this  model  was  represented  by  lero-order 
^yproximations  in  the  elemental  Kalman  filter  models.  No  work  in  this  thesis  makes  any  attempt  to 
verify  that  this  model  represents  the  conditions  encountered  by  the  LAMBDA  in  actiud  test  flights. 
Therefore,  it  is  important  to  acquire  actual  flight  data  and  use  the  tuning  algorithm  described  in 
Secti<m  4.1  to  develop  the  steady  state  Kalman  filter  gains  required  for  good  MMAE  performance 
in  actual  wind  conditions.  At  least,  the  tuning  derived  in  our  research  should  be  verified  against 
such  data. 

The  controllability  of  the  LAMBDA  must  be  verified  from  an  operator’s  perspective  while 
undergoing  automatic  dithers.  This  could  be  done  by  using  the  computerised  LAMBDA  flight 
simulator  found  at  Wright  Laboratory  Flight  Controls  Division,  Fli|pit  Controls  Techniques  Branch. 
It  must  be  established  that  the  video  display  is  not  too  jittery  for  the  pilot  to  track  a  desired  course 
comfortably  and  effectively.  Our  studies  verified  that  the  p-loading  on  a  hypothetical  pilot  on-board 
the  LAMBDA  is  not  uncomfortable.  This  was  done  to  extend  the  application  and  effectiveness  of 
an  MMAE  dither  to  manned  aircraft  with  the  assumption  that  the  same  dither  would  not  cause 
the  ground-based  LAMBDA  pilot  problems  in  controlling  the  unmanned  aircraft. 

Finally,  the  type  of  actuator  failures  simulated  in  this  thesis  are  realised  by  floating  or  missing 
control  surfaces.  That  is,  the  seroing  out  of  a  column  in  the  B  matrix  means  that  no  aerodynamic 
forces  are  applied  by  the  control  surface.  If  failed  actuators  are  realised  by  control  surfaces  fixed 
in  the  neutral  (or  worse,  non-neutral)  position  rather  than  failing  to  free-stream,  unmodeled  forces 
would  be  applied  and  poor  actuator  failure  identification  would  result. 

6.S  Recommended  Topics  for  Farther  Research 

Since  the  MMAE  identification  time  for  each  component  subject  to  failure  dq>ends  on  the  fre¬ 
quency  and  m^putude  of  dither,  it  would  be  advantageous  to  alter  the  dither  parameters  according 
to  the  type  failure  suspected.  For  instance,  if  the  longitudinal  channel  has  lost  the  use  of  one  eleva¬ 
tor,  it  would  be  meaningless  to  continue  to  dither  the  aircraft  as  a  frequency  and  magnitude  that 
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it  raited  to  enhance  MMAE  identificatkm  of  a  failed  etevator  actuator.  Rather,  a  dither  designed 
strictly  for  tensor  faihite  identification  should  begin.  Fbrthermoce,  ^iprcqniate  dithers  f<n  partially 
disabled  aircraft  should  be  designed  while  keeping  in  mind  which  fiight  control  onnponents  are 
available. 

An  aspect  of  subliminality  is  the  lack  of  annoyance  to  the  pilot.  Because  the  human  body  is 
able  to  perceive  very  small  MgiilM-  acceleration  and  linear  accderation,  it  may  be  futile  to  develop 
an  effective  dither  signal  that  it  imperceptible.  On  the  other  hand,  we  can  design  a  dither  signal  that 
may  not  be  an  annoyance  to  the  pilot.  Considering  the  nature  of  wind,  with  its  unpredictability, 
an  effective  dither  signal  mi^t  be  designed  to  have  the  /eel  of  atmospheric  turbulence  of  a  level 
just  above  that  through  which  the  aircraft  is  currently  fiying.  This  would  provide  the  aircraft  state 
excitation  required  for  effective  MMAE  failure  identificaticm,  and  it  would  not  subject  the  pilot  to 
unfamiliar  or  nauseating  dynamics. 

Dithers  having  the  form  of  swept  sine  waves  or  band-limited  noise  dithers  may  provide  the 
aircraft  state  excitation  required  for  MMAE  failure  identification  and  be  uiq;>redictable  enough 
to  avoid  pilot  annoyance.  As  shown  in  our  research,  there  are  several  frequencies  in  each  axis 
that  facilitate  good  MMAE  performance.  A  dither  signal  that  sweeps  across  these  fiequencies  will 
cover  the  best  frequency  for  each  component  at  time  intervals,  instead  of  just  dithering  at  some 
compromise  frequency  as  we  have  done.  A  random  frequency  sweep  may  make  the  dither  signal 
indistinguishable  from  wind  disturbance.  Another  suggestion  is  to  form  a  linear  combination  of 
sinusoids.  The  sensitive  frequencies  for  several  types  of  failure  identifications  could  be  superimposed 
on  one  dither  signal  to  form  a  linear  combination,  so  that  the  best  dither  for  all  components  is 
applied  continuously. 

While  testing  failure  identification  times  as  dither  frequency  and  magnitude  are  varied,  a 
course  discretisation  of  frequency /magnitude  points  was  used  to  form  the  test  parameter  space. 
Finer  discretisation  may  clear  up  problems  of  identifying  trends  in  identificaticm  times  related  to 
the  roll  rate  sensor  failure  and  yaw  rate  sensor  failure.  Another  solution  to  creating  more  consistent 
trends  would  be  to  force  the  failure  being  tested  to  occur  at  exactly  the  same  phase  angle  of  each 
different  frequency  of  dither.  This  would  ensure  that  the  MMAE  attempts  to  identify  failures  at 
similar  d]mainic  changes  for  all  frequencies. 
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Another  propoial  for  altering  our  experimeiUal  procedure  to  provide  mcne  coniistent  reralti 
it  to  set  the  dither  phase  offset  to  sero,  then  test  for  tensOT  failure  responses.  The  strat^y  is  to 
note  the  degree  of  aircraft  state  excitation  required  for  good  sensor  failure  identification.  This  will 
establish  the  amount  of  aircraft  state  excitation  that  should  remain  constant  from  dither  frequency 
to  dither  frequency.  In  the  experiments  of  this  thesis,  input  dither  magnitude  was  kept  constant 
over  all  frequencies  while  aircraft  state  excitation  magnitude  was  allowed  to  vary  greatly.  The  effect 
of  dither  frequency  changes  could  be  isolated  further  by  altering  input  dither  magnitude  to  ke^ 
aircraft  state  excitation  magnitude  constant  over  various  dither  frequencies. 

More  study  should  by  undertaken  to  establish  the  best  phase  relationship  between  left  and 
right  control  channels.  This  could  be  accomplished  by  offsetting  opposite  control  surface  dithers  by 
180°  and  performing  only  actuator  failures  as  dither  magnitude  is  increase  from  sero.  A  minimum 
degree  of  control  surface  deflection  for  good  actuator  failure  identification  should  be  established 
by  experimentation.  The  180°  phase  between  channels  should  promote  maximum  efficiency  in 
identifying  left  from  right  actuator  failures.  Since  left  and  right  channels  will  attempt  to  cancel  each 
other  out,  the  effect  on  aircraft  state  excitation  should  be  minimal  with  all  actuators  operational. 
The  next  step  is  to  shift  the  phase  from  180°,  thereby  increasing  aircraft  state  excitation  to  the 
point  established  by  experiment  as  described  in  the  previous  paragraph.  The  result  shoidd  be 
a  dither  magnitude  and  phase  that  provide  a  balanced  system  input  for  the  best  MMAE  failure 
identification  for  both  actuators  and  sensors. 

An  important  suggestion  is  to  dither  all  surfaces  at  the  same  frequency  for  each  test.  This 
assures  that  no  other  frequencies  are  introduced  from  one  channel  through  the  cross  coupling  terms 
of  the  other  channel.  All  surfaces  must  be  dithered  in  each  test,  however.  Zero  excitation  in  one 
channel  will  lead  to  an  unreliable  MMAE  response  for  that  channel,  which  will  detract  from  MMAE 
probabilities  being  formed  in  the  channel  that  is  being  dithered. 

It  was  demonstrated  in  Section  5.1  that  the  MMAE  is  able  to  identify  the  failure  of  a  critical 
fii^t  control  system  component,  the  yaw  rate  sensor.  Loss  of  its  feedback  signal  to  the  washout 
filter  caused  the  aircraft  to  go  unstable.  The  MMAE  readily  provides  good  estimates  of  the  yaw 
rate  sensor  signal  despite  the  sensor’s  failure.  It  follows  that  these  estimates  may  replace  the  yaw 
rate  sensor  signal  in  the  event  of  such  a  failure  and  thus  provide  stable  control  of  the  aircraft. 
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Similarly,  the  pitch  rate  sensor  measurement  could  be  replaced  by  an  MMAE  estimate  of  the  pitch 
rate  state  in  case  of  a  pitch  rate  sensor  failure.  Although  the  aircraft  is  not  unstable  with  this 
failure,  improved  flight  control  system  performance  can  be  realised.  An  investigaUion  into  MMAE 
state  estimate  replacement  of  sensor  signals  is  recommended. 

Finally,  knowing  the  behavior  of  scalar  residuals  with  respect  to  their  correspondence  to 
feedback  or  non-feedback  sensors  allows  one  to  devise  a  strategy  for  effective  residual  monitoring. 
This  is  especially  important  when  dealing  with  sensors  that  provide  feedback  to  the  QFT  flight 
control  system,  since  their  failures  have  a  tendency  to  take  longer  to  identify  than  those  of  non¬ 
feedback  sensors. 

6.4  Report  Summary 

The  research  in  this  thesis  seeks  to  identify  the  best  dither  routine  for  enhancing  MMAE 
failure  identification  and  to  investigate  the  performance  of  a  hierarchical  structure  in  the  MMAE 
identification  of  dual  failures.  The  theory  behind  MMAE  is  presented  in  Chapter  I  along  with  the 
research  objectives.  A  review  of  previous  MMAE  research  was  undertaken  to  establish  what  is 
known  and  what  is  as  yet  unknown  about  MMAE,  so  that  the  present  work  will  serve  to  build  on 
that  knowledge.  The  methods  for  achieving  the  research  objectives  were  presented  in  Chapter  m, 
along  with  justification  for  the  structure  of  models  used  in  computer  simulations.  In  Chapter  IV, 
the  results  of  testing  are  presented  and  analysed  with  respect  to  the  research  objectives.  Support 
for  secondary  conclusions  not  related  to  the  primary  research  objectives  is  provided  in  Chapter  V. 
A  summation  of  conclusions  is  found  in  the  present  chapter.  Supporting  appendices  give  complete 
insight  to  all  restdts  and  conclusions  reported. 


6-8 


Appendix  A.  Dimenaional  SteAUity  Derivativea 


The  primed  dimeniional  stability  derivatives  used  in  the  LAMBDA  truth  model  for  this  thesis 
are  the  result  of  an  analysis  of  data  from  LAMBDA  flights  conducted  by  WL/FIGS  [26].  Thble  1.1 
gives  the  nominal  flight  conditions  corresponding  to  the  the  values  in  Tables  A.l  and  A.2.  They  are 
to  be  used  in  Equation  (3.1)  which  describes  the  LAMBDA’S  aerodynamic  characteristics  in  state 
space  format.  Also,  the  wind  states  to  aircraft  stsdes  transformation  matrix  of  Equation  (3.24) 
makes  use  of  these  same  stability  derivatives. 

Table  A.l  LAMBDA  longitudinal  primed  dimensional  stability  derivatives. 


Symb. 

Value 

Definition 

XL 

-0.413963  X  10-^ 

Change  in  longitudinal  force  due  to  change  in  velocity 

XL 

4.51655 

Change  in  longitudinal  force  due  to  change  in  angle  of  attack 

XL 

2.76989 

Change  in  longitudinal  force  due  to  change  in  pitch  rate 

XL 

-32.1700 

Change  in  longitudinal  force  due  to  change  in  pitch  angle 

XL 

-0.300342 

Change  in  longitudinal  force  due  to  change  in  left  elevator  angle 

XL 

-0.300342 

Change  in  longitudinal  force  due  to  change  in  right  elevator  angle 

0.970785  X  10-^ 

Change  in  longitudinal  force  due  to  change  in  left  aileron  angle 

XL 

0.970785  X  10-^ 

Change  in  longitudinal  force  due  to  change  in  ri^t  aileron  anj^e 

ZL 

-0.265210  X  10-* 

Change  in  vertical  force  due  to  change  in  velocity 

ZL 

-4.01458 

Change  in  vertical  force  due  to  change  in  angle  of  attack 

0.977740 

Change  in  vertical  force  due  to  change  in  pitch  rate 

Z’e 

0 

Change  in  vertical  force  due  to  change  in  pitch  angle 

ZL 

-0.150277 

Change  in  vertical  force  due  to  change  in  left  elevator  angle 

ZL 

-0.150277 

Change  in  vertical  force  due  to  change  in  right  elevator  angle 

ZL 

-0.304528 

Change  in  vertical  force  due  to  change  in  left  aileron  angle 

^L 

-0.304528 

Change  in  vertical  force  due  to  change  in  right  aileron  angle 

ML 

-0.228065  X  10-* 

Change  in  pitching  momoit  due  to  change  in  velocity 

ML 

-45.4757 

Change  in  pitching  moment  due  to  change  in  angle  of  attack 

ML 

-3.38135 

Change  in  pitching  moment  due  to  change  in  pitch  rate 

ML 

0 

Change  in  pitching  moment  due  to  change  in  pitch  angle 

ML 

-23.2027 

Change  in  pitching  moment  due  to  change  in  left  elevator  angle 

ML 

-23.2027 

Change  in  pitching  moment  due  to  change  in  right  elevator  angle 

ML 

-3.91485 

Change  in  pitching  moment  due  to  change  in  left  aileron  angle 

ML 

-3.91485 

Change  in  pitching  moment  due  to  change  in  right  aileron  angle 

'bble  A.2  LAMBDA  lateral  primed  dimeniional  stability  derivatives. 


Symb. 

Value 

Definition 

mi 

-0.185589 

Change  in  lateral  f<»ce  due  to  change  in  sideslip  angle 

IS 

-0.167993  X  10-^ 

Change  in  lateral  force  due  to  change  in  roll  rate 

IS 

0.190265 

Change  in  lateral  force  due  to  change  in  roll  angle 

-0.99528;> 

Change  in  lateral  force  due  to  change  in  yaw  rate 

V' 

^1.1 

0 

Change  in  lateral  force  due  to  change  in  left  elevator  angle 

0 

Change  in  lateral  force  due  to  change  in  right  elevator  angle 

IS 

0 

Change  in  lateral  force  due  to  change  in  left  aileron  angle 

IS 

0 

Change  in  lateral  force  due  to  change  in  right  aileron  angle 

EH 

0.138001 

Change  in  lateral  force  due  to  change  in  rudder  angle 

-8.84221 

Change  in  rollii^  moment  due  to  change  in  sideslip  angle 

-11.1274 

Change  in  rolling  moment  due  to  change  in  roll  rate 

K 

2.00065 

Change  in  rolling  moment  due  to  change  in  yaw  rate 

3.01717 

Change  in  rolling  moment  due  to  change  in  left  elevator  angle 

-3.01717 

Change  in  rolling  moment  due  to  change  in  right  elevator  angle 

66.3312 

Change  in  rolling  moment  due  to  change  in  left  aileron  angle 

-66.3312 

Change  in  rolling  moment  due  to  change  in  right  aileron  angle 

-0.662067 

Change  in  rolling  moment  due  to  change  in  rudder  angle 

12.8746 

Change  in  yawing  moment  due  to  change  in  sideslip  angle 

-0.226784 

Change  in  yawing  moment  due  to  change  in  roll  rate 

-0.864736 

Change  in  yawing  moment  due  to  change  in  yaw  rate 

-0.280877  X  10-^ 

Change  in  yawing  moment  due  to  change  in  left  elevator  angle 

0.280877  X  10-^ 

Change  in  yawing  moment  due  to  change  in  right  elevidor  angle 

-2.15844 

Change  in  yawing  moment  due  to  change  in  left  aileron  angle 

2.15844 

Change  in  yawing  moment  due  to  change  in  right  aileron  angle 

-21.9503 

Change  in  yawing  moment  due  to  change  in  rudder  angle 

Appendix  B.  Bode  Plots  of  Actuator  Transfer  Functions 

The  natural  amplitude  ratio  reaponse  of  the  eight  aircraft  states  to  control  surface  inputs  is 
presented  in  this  appendix  in  the  form  of  logarithmic  magnitude  Bode  plots.  This  data  is  used  in 
the  analysis  of  Section  4.2.1  as  a  means  of  correlating  MMAE  faulure  identification  times  to  the 
natural  response  of  aircraft  states  to  dither  inputs. 

Each  caption  indicates  the  input  and  output  of  the  transfer  function  used  in  generating 
the  indicated  plot.  A  constant  log-magnitude  line  derived  by  subtracting  20  dB  from  the  peak 
magnitude  is  drawn  in  each  plot.  The  crossing  of  this  line  with  the  log-magnitude  response  indicates 
the  bandwidth  of  the  response.  Bandwidth  could  be  derived  using  other  methods,  but  this  one  seems 
to  generate  more  consistent  results  as  each  state  is  excited  by  different  control  surfaces. 

The  frequency  of  the  peak  log-magnitude  is  indicated  in  the  caption  by  Upk  given  in  radians  per 
second,  as  is  the  bandwidth,  uibw  •  When  required,  an  upper  bandwidth  frequency  is  be  indicated 
by  u)Bw,„,r  aod  a  lower  bandwidth  frequency  by 


Figure  B.l  Log  Magnitude  Response  of  forward  velocity  to  Left  Elevator.  Peak  Magnitude  Minus 
20  dB  is  56.72  dB.  Upt  =  0.25  and  tifsw  =  0-36  rad/sec. 
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Figure  B.2  Log  Magnitude  Eesponse  of  Angle  of  attack  to  Left  Elevator.  Peak  Magnitude  Minus 
20  dB  is  *16.78  dB.  =  0.24  and  ubw  =  13.55  rad/sec. 


Figure  B.3  Log  Magnitude  Response  of  Pitch  Rate  to  Left  Elevator.  Peak  Magnitude  Minus  20 
dB  is  2.62  dB.  Ufk  =  0.25,  =  0.17  and  UBw,,^r  =  18.91  rad/sec. 
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Figure  B.4  Log  Magnitude  Eesponse  of  Pitch  An^e  to  Left  Elevator.  Peak  Magnitude  Minus  20 
dB  is  14.66  dB.  =  0.25,  =  0.14  and  wbw,,,.,  =  0.42  rad/sec. 


Figure  B.5  Log  Magnitude  Response  of  Sideslip  Angle  to  Left  Aileron.  Peak  Magnitude  Minus 
20  dB  is  -11.40  dB.  =  0.01  and  Vgw  =  5.26  rad/sec. 
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Figure  B.6  Log  Magnitude  Beaponae  of  Boll  Bate  to  Left  Aileron.  Peak  Magnitude  Minna  20  dB 
ia  -4.68  dB.  =  4.20  and  ubw  =  113.20  rad/aec. 


Figure  B.7  Log  Magnitude  Beaponae  of  Boll  Angle  to  Ldt  Aileron.  Peak  Magnitude  Minua  20 
dB  ia  27.00  dB.  =  0.01  and  ubw  =  0.25  rad/aec. 
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Figure  B.8  Log  Magnitude  Response  of  Yaw  Rate  to  Left  Aileron.  Peak  Magnitude  Minus  20  dB 
is  12.53  dB.  =  0*01  and  uigw  =  0.26  rad/sec. 


Figure  B.9  Log  Magnitude  Response  of  Sideslip  Angle  to  Left  Rudder.  Peak  Magnitude  Minus 
20  dB  is  -10.88  dB.  =  3.60  and  cifffw  =  7.16  rad/sec. 
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Figure  B.IO 


Figure  B.ll 


Log  Magnitude  Response  of  Boll  Rate  to  Left  Rudder.  Peak  Magnitude  Minus  20 
dB  is  -10.87  dB.  =  3.60,  wbw,...,  =  0.01  and  =  8.00  rad/sec. 


Log  Magnitude  Response  of  Boll  Angle  to  Left  Rudder.  Peak  Magnitude  Minus  20 
dB  is  8.83  dB.  =  0.01  and  ubw  =  0.25  rad/sec. 
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Figure  B.12  Log  Magnitude  Retponae  of  Yaw  Rate  to  Left  Rodder.  Peak  Magnitude  Minns  20 
dB  is  0.14  dB.  =  3.70  and  cross-over  frequencies  are  at  wbw  =  0.11,  1.23,  and 
11.87  rad/sec. 
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Appendix  C.  Difference  Efuations  for  QFT  PrefiUers  and  Compensators 


Listed  in  this  aiq^dix  are  the  difference  eqaations  for  the  preliltm,  ccunpensatcm,  and 
washout  filters  for  the  Quantitative  Feedback  The<»7  fiight  control  system  designed  by  Capt  Ras¬ 
mussen  [26].  The  sample  time  of  this  design  is  =  20  msec.  Refer  to  Figure  3.1  for  a  high-level 
block  diagram  of  this  fiight  control  system. 

Prefilter  F.ll  has  the  input  Pitch  Rate  Command,  PITCHCMD,  and  the  output  FllC  which 
is  summed  with  the  Pitch  Rate  Measurement,  PITCHJBATE,  to  form  the  Pitch  Rate  Error,  QERR. 

FllA(k)  =  8.9573  x  10"^  x  FllA(k  -  1)  -|- 1.000  x  PITCHCMD(k)  - 
9.1388  X  10-'  X  PITCHCMD(k  -  1) 

FllB(le)  =  8.1818  x  10“'  x  FllB(k  -  1)  -S- 1.000  x  F11A(*)  -|- 
1.0000  X  FllA(k  -  1) 

F11C(*)  =  8.3486  X  10“'  x  F11C(*  -  1)  -I-  9.0874  x  10"*  x  FllB(k)  -|- 
9.0874  X  10"*  X  FllB(k  -  1) 

Summing  block: 

QERR(k)  =  F11C(*)  -  PITCH  JLATE(*)  (C.2) 

Compensator  G.ll  has  the  input  Pitch  Rate  E^rror,  QERR,  and  the  output  GllD  which  is 
range  limited  to  produce  the  Elevator  Command,  ELEVATOR-CMD. 

G11A(*)  =  1.1111  X  10"' xGllA(k-l) -I- 1.0000  xQERR(*)- 

8.0180  X  10"'  X  QERR(*  -  1)  (C.3a) 

GllB(jfe)  =  9.6078  X  10"'  x  G11B(*  -  1)  -|- 1.0000  x  GllA(k)  - 

8.4332  X  10"'  X  GllA(k  -  1)  (C.3b) 

G11C(*)  =  6.1538  X  10"'  X  G11C(*  -  1)  -  3.0769  x  lO"'  x  G11C(*  -  2)  -l- 
1.0000  X  G11B(*)  -  1.8462  x  GllB(k  -  1)  -|- 

8.5741  X  10-'  X  GllB(k  -  2)  (C.3c) 

GllD(jfc)  =  1.0000  X  G11D(*  -  1) -I- 3.7457  X  G11C(*) + 
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(C.la) 

(C.lb) 

(C.lc) 


3.7457  xGllC(ik-l) 


(C.8d) 


Limit  G11D(5)  (aad  coniequently  GllD(5  -  1))  to  dbl5*. 

ELBVAT01LCMD(5)  =  G11D(5)  (C.4) 

Prcfilter  FJ{2  hms  the  input  BoH  Rate  Command,  ROLLCMD,  aad  the  output  F22A  whidi 
if  nunmed  with  the  Roll  Rate  Meaeurement,  ROLLJtATE,  to  fionn  the  Pitch  Rate  Error,  PERR. 

F22A(5)  =  1.0000  x  ROLLCMD(5)  (C.5) 

Summing  block: 

PERR(h)  =  F22A(5)  ~  ROLL^TE(5)  (C.6) 

Compeniator  G-22  has  the  input  Roll  Rate  ESrror,  PERR,  and  the  output  G22C  which  is 
range  limited  to  produce  the  Aileron  Commaad,  AILERON.CMD. 

G22A(*)  =  1.0884  x  G22A(*  - 1)  -  3.9225  x  lO'^  x  G22A(4  -  2)  + 

1.0000  X  PERR(5)  -  1.6083  X  PERR(5  -  1)  + 

6.4242  X  10~^  X  PERR(5  -  2) 

G22B(5)  =  9.9860  X  10-^  X  G22B(i  -  1)  +  1.0000  X  G22A(5) - 
9.990  X  10~^  X  G22A(h  -  1) 

G22C(*)  =  9.9860  X  10"^  xG22C(*-l)  + 5.3345  X  10"*  xG22B(*)  + 

5.3345  x  10~’  X  G22B(5  -  1) 

Limit  G22C(h)  (aad  consequently  G22C(5  -  1))  to  ±15*. 

AILERON.CMD(5)  =  G22C(5)  (C.8) 

Prefilter  F^3  has  the  input  Sideslip  Angle  Cmnmaad,  BETA_CMD,  aad  the  output  F33B 
which  is  summed  with  the  Sideslip  Angle  Measurement,  BETA,  to  form  the  Sideslip  Angle  Eirror, 


(C.7.) 

(C.Tb) 

(C.Tc) 


C-S 


BERR. 


F33A(*)  =  9.4X75  x  10"^  x  F33A(5  -  1)  +  1.0000  x  BETA-CMD(4)  - 

7.3913  X  10-^  X  BETA-CMD(5  -  1)  (C.9a) 

F33B(*)  =  9.6078  x  lO’^  x  F33B(&  -  1)  +  1.5471  x  10"^  x  F33A(*)  - 

1.3719  X  10"*  X  F33A(ifc  -  1)  (C.9b) 

Stunming  block: 

BERR(k)  =  F33B(k)  -  BETA(k)  (C.IO) 

Compensator  G^3  has  the  input  Sideslip  Angle  Error,  BERR,  and  the  output  G33B. 

G33A(*)  =  6.6667  x  10-^  X  G33A(t  -  1)  +  1.0000  x  BERR(*)  + 

10.0000  X  10"^  X  BERR(k  -  1)  (C.lla) 

G33B(fc)  =  6.6667  x  10"^  x  G33B(4  -  1)  ~  3.8194  x  10"*  x  G33A(*)  - 

3.8194  X  10"’  X  G33A(ife  -  1)  (C.llb) 

The  Washout  Filter  has  the  input  Yaw  Rate  Measurement,  YAW  .RATE,  and  the  output  Yaw 
Damper  Feedback,  YD,  which  is  summed  with  the  output  of  compensator  G.33,  G33B,  and  range 
limited  to  produce  the  Rudder  Command,  RUDDER-CMD. 

YD(*)  =  9.8020  X  10"^  x  YD(k  -  1)  +  3.9604  x  10"^  x  YAW.RATE(*)  - 

3.9604  X  10"^  X  YAWJIATE(*  -  1)  (C.12) 

Summing  block: 

RUDDER.CMD(*)  =  G33B(*)  -  YD(*)  (C.13) 
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Appendix  D.  Failure  ID  Time  vs  g-foreea  aa  Diiher  Magnitude  Changes 

The  figures  and  tables  of  this  appendix  are  the  results  of  studies  ■imilar  to  those  of  Secticm  4.2 
except  that  magnitude  instead  of  frequency  is  being  changed  from  trial  to  trial.  Trial  numbos  have 
varying  decimal  digits  to  indicate  changes  in  dither  magnitude.  Identical  digits  in  the  units  position 
of  the  trial  numbers  indicate  simulations  with  identical  dither  frequencies. 

A  complete  analysis  of  the  following  data  is  accomplished  in  Subsection  4.2.1.  In  particular, 
the  tradeoff  between  adjusting  dither  magnitude  or  dither  frequency  is  considered.  Information 
contained  in  Thbles  D.l  through  D.6  is  condensed  in  Ttble  4.15  found  on  page  4-38.  Likewise, 
information  contained  in  Tables  D.7  through  D.14  is  condensed  in  Table  4.16  on  page  4-41. 
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Tkble  D.l  Results  of  varying  dither  magnitude  to  alter  Right  Elevator  Actuator  failure  identifi¬ 
cation  time  and  vertical  y-forces.  _ 


Trial 

4 

4.1 

4.2 

Failure  ID  time  [sec] 

0.24 

0.29 

0.33 

ESlevator  Dither 

■■ 

Ml 

Magnitude  [deg/sec] 

6.00 

mBSm 

Frequency  [rad/sec] 

1.6653 

1.6653 

Vertical  Acceleration  [y’s] 

maximum  occurrence 

0.2726 

+2o' 

+l<r 

0.0403 

mean 

-0.0230 

-0.0032 

-0.0028 

—l(r 

-0.0468 

-0.0402 

—2a’ 

-0.0904 

Tninimmn  occurrence 

-0.3444 

-0.2828 

-0.2712 

D-2 


Vertical  Acceleration,  [g's] 


Right  Etevalor  Actuator  Falun 


Time  to  identify  fatture.  [sec] 


Q.lpft 


0.22 


•t-A2sfgmat)ouncfs 


^■29sec.  ^ 

0.24  0.26  0.28  0.3 

Time  to  identify  failure,  [sec] 


0.32 


■X 

■X 


Figure  D.l  ^-forces  vs  ED  time  for  Bight  Elevator  Actuator  failure  as  magnitude  changes. 
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Tbble  D.2  Eesiilts  of  varying  dither  magnitude  to  alter  Left  Elevator  Actuator  failure  identiiica 
tion  time  and  vertical  ^-forces. 


THal 


Failure  ID  time  [sec] 


Elevator  Dither 

Magnitude  [deg/sec] 
Frequency  [rad/sec] 


Vertical  Acceleration  [;’>] 
maximum  occurrence 


mean  -0.0230 
-l<r  -0.0871 
-2<r  -0.1512 
minimum  occurrence  -0.3444 


I^ble  D.3  Results  of  varying  dither  magnitude  to  alter  Forward  Velocity  Sensor  failure  identifi¬ 
cation  time  and  vertical  ^-forces.  _ _ 


IMal 

4 

4.1 

4.2 

Failure  ID  time  [sec] 

0.58 

0.83 

0.93 

Elevator  Dither 

Magnitude  [deg/sec] 

6.00 

5.00 

4.00 

frequency  [rad/sec] 

1.6653 

1.6653 

1.6653 

Vertical  Acceleration  {; ’s] 

maximum  occurrence 

0.2510 

0.2778 

0.2726 

-|-2<r 

0.1053 

0.0839 

0.0722 

+l<r 

0.0412 

0.0403 

0.0347 

mean 

-0.0230 

-0.0032 

-0.0028 

-l(r 

-0.0871 

-0.0468 

-0.0402 

— 2<r 

-0.1512 

-0.0904 

-0.0777 

miniiniim  occurrence 

-0.3444 

-0.2828 

-0.2712 
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Vertical  Aoceieration,  [g's] 


Forward  Veiodty  Sensor  Failure 


III.- 


0.5  0.55  0.6  0.65  0  7  0.75  0.8  0.85  0.9 

Titne  to  identify  failure,  [sec] 


•fA  2  sigma  bounds 


•  ••  ^  . 


_ _ 

^ 


_ X 


rcO.64  sec. 


0.5  0.55  0.6  0.65  0.7  0.75  0.8  0.85  0.9 

Time  to  identify  failure,  [sec] 


Figure  D.3  g-forces  va  ID  time  for  Forward  Velocity  Sensor  failure  as  magnitude  changes. 


Table  D.4  Results  of  varjring  dither  magnitude  to  alter  Anj^  of  Attack  Sensor  failure  identifica¬ 
tion  time  and  Tertical  ^-forces. 


Trial 

4 

4.1 

4.2 

Failure  ID  time  [sec] 

0.10 

1.34 

2.26 

Elevator  Dither 

mmm 

Magnitude  [deg/sec] 

6.00 

5.00 

»filM 

Erequency  [rad/sec] 

1.6653 

1.6653 

1.6653 

Vertical  Acceleration  [^'sj 

■■i 

maximum  occurrence 

0.2510 

0.2778 

+2o' 

0.1053 

0.0839 

+lv 

0.0412 

0.0403 

0.0347 

mean 

-0.0230 

-0.0032 

-0.0028 

— l<r 

-0.0871 

-0.0468 

-0.0402 

— 2<r 

-0.1512 

-0.0904 

-0.0777 

minimuTn  occuirence 

-0.3444 

-0.2828 

-0.2712 
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Vertical  Acceleration,  [g's]  Vertical  Acceleration,  [g's] 


0.4 


Angle  of  Attack  Sensor  Failure 


03 

02 

0.1 

0 


-0.5 


absmax  x- 


K 


•t-2sig 
•<■1  sig 
mean 
-1  sig 
•2  sig 


abs  min  x- 


0  0.5  1  1.5  2 

Time  to  identify  failure,  [sec] 


•*■/•  2  sigma  bounds 


Time  to  identify  failure,  [sec] 


Figure  D.4  g-forces  va  ID  time  for  Angle  of  Attack  Sensor  failure  as  magnitude  changes. 
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Table  D.5  Eesulta  of  var]rmg  dither  magnitude  to  alter  Pitch  Rate  Senior  failure  identificaticm 
time  and  vertical  ^-forcei.  _ _ 


THal 

4 

4.1 

4.2 

Failure  ID  time  [sec] 

0.33 

0.42 

0.47 

Elevator  Dither 

■H 

■■ 

Magnitude  [deg/sec] 

6.00 

Frequency  [rad/ sec] 

1.6653 

1.6653 

Vertical  Acceleration  [y’lj 

maximum  occurrence 

0.2726 

+2<r 

0.0722 

+l<r 

0.0403 

0.0347 

mean 

-0.0230 

-0.0032 

-oca28 

-l<r 

-0.0468 

-0.0402 

—2a 

-0.0777 

TniniwiiiTn  occurrence 

-0.3444 

-0.2712 
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Vertical  Acceleration,  [g's]  Vertical  Acceleration,  [g’s] 


Pitch  Sensor  Failure 


Time  to  identify  failure,  [sec] 


Figure  D.5  ^-forces  va  ID  time  for  Pitch  Rate  Sensor  failure  as  magnitude  changes. 
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Tabk  D.6  Results  of  varying  dither  magnitude  to  alter  Pitch  Angle  Sensor  foilnre  identiiicatkHi 
time  and  vertical  ^-forces. 


IHal 

4 

4.1 

Failure  ID  time  [sec] 

0.93 

1.05 

1.19 

Elevator  Dither 

■■ 

■■ 

Magnitude  [d^/sec] 

6.00 

Frequency  [rad/sec] 

1.6653 

1.6653 

1.6653 

Vertical  Acceleration  {g'§] 

maximum  occurrence 

0.2510 

0.2726 

+2<t 

0.1053 

0.0722 

+10- 

0.0412 

0.0403 

0.0347 

Tnpjm 

imm 

-0.0032 

-0.0028 

-Iff 

-0.0871 

-2ff 

•0.1512 

minimum  occurrence 

-0.3444 

Em 
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Vertical  Acceleration,  [g's]  Vertical  Acceleration,  (g's] 


0.4, 


PMch  AiH^  Senaor  Failuie 


D-13 


y  X 


Table  D.7  Results  of  varying  dither  magnitude  to  alter  Bi^t  Aileron  Actuator  failure  identifica¬ 
tion  time  and  horisontal  ^-forces. 


5 

5.1 

5.2 

5.3 

Fhilnre  ID  time  [sec] 

0.24 

0.79 

1.87 

Aileron  Dither 

■■1 

Magnitude  [deg/sec] 

4.00 

3.00 

2.00 

frequency  [rad/sec] 

3.6193 

3.6193 

3.6193 

3.6193 

Horisontal  Acceleration  [y’s] 

maximum  occurrence 

0.5590 

+2tr 

BBS?* 

+l<r 

■onffl 

mean 

0.0158 

0.0322 

0.0067 

— l<r 

-0.1416 

-0.0693 

-0.0538 

-0.0638 

— 2<y 

-0.2989 

-0.1802 

*t*b 

-0.1343 

mmimntn  occurrence 

-0.5920 

-0.5185 

-0.4979 
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Right  Aileron  Actuator  Failure 


0.8 

•S’  0  8 

abemax 

. . . 

n  vi.o 
2 

i 

1  0-2 

•t-28ig 
+1  sig 

X — 

H- - 

w.  - - 

^  — It  — 

- - -  —  _ _ 

<  ° 

mean 

— — — -  K 

1-Oi 

La 

I 

-1  sig 
-2  sig 

— —  —  —  —  —  —  —  — 

X-  - - 

* 

. 

X' 

-0.6 

^  o 

abs  min 

. . . . . 

X* . 

—  »  —  «  - 

• 

I 

Time  to  identify  failure,  [sec] 


+/- 2  sigma  bounds 


Figure  D.7  y-forces  vs  ID  time  for  Bight  Aileron  Actuator  failure  as  mi^nitude  changes. 


I^ble  D.8  Results  of  varying  dither  magnitude  to  alter  Left  Aileron  Actuator  failure  identification 
time  and  horisontal  ^-forces. 
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Left  Aileron  Actuator  Failure 


4/-  2  sigma  bounds 


Figure  D.8  g-forces  v$  ID  time  for  Left  Aileron  Actuator  failure  as  magnitude  changes. 
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Table  D.9  Results  of  varying  dither  magnitude  to  alter  Bight  Rudder  Actuator  failure  identifica¬ 
tion  time  and  horisontal  ^-forces. 


THal 

5 

5.1 

5.2 

5.3 

Ftdlnre  ID  tur  [sec] 

0.S6 

0.90 

1.20 

1.72 

Rudder  Dither 

■■ 

H 

■■ 

■■ 

Magnitude  [deg/sec] 

MWlif 

Frequency  [rad/sec] 

3.6193 

mi 

Horisontal  Acceleration  [y’s] 

maximum  occurrence 

Dia 

-|-2o' 

mSi 

mm 

-f  l<r 

ni 

mean 

0.0322 

-lo- 

-0.0538 

-0.0638 

—2<r 

-0.2989 

mm 

-0.1343 

minimiifn  occurrence 

-0.5920 

lEg 

-0.4979 
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Horizontal  Acceleration,  [g’s]  Horizontal  Acceleration,  ^’s] 


Right  Rudder  Actuator  Failure 


D-19 


xAxAx 


Table  D.IO  Results  of  varying  dither  magnitude  to  alter  Left  Rudder  Actuator  failure  identifica¬ 
tion  time  and  horisontal  ^-forces. 


Trial 

5 

5.1 

5.2 

5.3 

failure  ID  time  [sec] 

0.53 

1.40 

2.38 

Rudder  Dither 

■■ 

■■ 

■■ 

Magnitude  [deg/sec] 

6.00 

wBm 

frequency  [rad/sec] 

3.6193 

3.6193 

WEM 

ESI 

Horizontal  Acceleration  [9’s] 

1 

maximum  occurrence 

0.7117 

0.6878 

0.6187 

-|-2<r 

0.3304 

0.2631 

0.1731 

0.1523 

0.1182 

mean 

0.0158 

0.0415 

—l<r 

-0.1416 

-0.0693 

—2<r 

-0.2989 

-0.1802 

-0.1399 

-0.1343 

minimum  occurrence 

-0.5920 

-0.5185 

-0.4979 
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Horizontal  Acceleration,  (g's)  Horizontal  Acceleration,  [g’s] 


Left  Rudder  Actuator  Failure 


Time  to  identify  failure,  [sec] 


+/•  2  sigma  bounds 
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Figure  D.IO  j^-forces  v«  ID  time  for  Left  Rudder  Actuator  failure  as  magnitude  changes. 
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Tkble  D .  1 1  Results  of  varying  dither  magnitude  to  alter  Sideslip  Angle  Sensor  failure  identification 
time  and  horisontal  ^-forces. 
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Figure  D.ll  j^-forces  va  ID  time  for  Sideslip  Angle  Sensor  failure  as  magnitude  changes. 
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Table  D.12  Results  of  varying  dither  magnitude  to  alter  Roll  Rate  Sensor  failure  identification 
time  and  horisontal  y-forces. 
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Table  D.13  Results  of  varying  dither  magnitude  to  alter  Roll  Angle  Sensor  failure  identification 
time  and  horisontsd  i;-forces. 
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Figure  D.13  ^-forces  vs  ID  time  for  Roll  Angle  Sensor  failure  as  magnitude  changes. 


D-27 


Xf  Xf  X 


l^ble  D.14  Result!  of  varying  dither  magnitude  to  alter  Yaw  Bnte  Sensor  failure  identification 
time  and  horiiontal  ^-forces. 


IMal 

5 

5.1 

5.2 

5.3 

Failure  ID  time  [sec] 

0.76 

0.85 

0.97 

1.11 

Aileron  Dither 

■■ 

■■ 

Magnitude  [deg/sec] 

6.00 

2.00 

Frequency  [rad/sec] 

3.6193 

3.6193 

3.6193 

3.6193 

Rudder  Dither 

■■1 

Magnitude  [deg/sec] 

6.00 

Frequency  [rad/sec] 

3.6193 

3.6193 

3.6193 

3.6193 

Horisontal  Acceleration  [^’s] 

maximum  occurrence 

0.7117 

0.6878 

0.6187 

+2o' 

0.3304 

0.2631 

0.2043 

+l<r 

0.1731 

0.1523 

0.1182 

mean 

0.0158 

0.0415 

-l(r 

-0.1416 

-0.0693 

-2<r 

•0.1802 

-0.1399 

minimuTn  occurrence 

-0.5185 

-0.4979  1 

D-28 


Horizontal  Acceleration,  [g's]  Horizontal  Aooeleralion,  [g’s] 


Yaw  Rate  Seneor  Failure 


0.8 

0.6 


abemax  x- . 


■X 


■••X 


0.4 

02 

0 

02 


+2  sig  X - 

X - 

+l8ig  X- - - - 1 1 T 1 - 

mean  - - -  x— - 

- - - - - 

-1  sig  - -  ^  ^ - - - 

-2  sig  - - 


0.6 

0.8 


absmin 


0.7 


x- 


X- 


•X 


oli 

Tinte  to  identify  failure,  [sec] 


K 


1.1 


2  sigma  bounds 


Figure  D.14  ^-forces  v«  ID  time  for  Yaw  Rate  Sensor  failure  as  magnitude  changes. 
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Appendix  E.  Single  Failure  ProhakHUy  Plots 


MMAE  performance  against  single  failures  with,  the  optimal  dither  of  Equation  (4.6)  is  pre¬ 
sented  in  a  more  expanded  form  in  this  appendix  than  in  Figure  4.15  on  page  4-43.  An  average 
probability  of  ten  Monte  Carlo  runs  is  presented  in  each  of  the  following  plots.  For  convenience, 
Thble  3.4  is  repeated  below  as  Tkble  E.l  so  that  the  codes  in  the  plots  are  easily  interpreted  as  the 
indicated  filters.  Two  codes  next  to  each  other  as  in  A2S4  indicate  a  secondary  filter  of  a  level-1 
bank  which  hypothesises  two  failed  components. 

Table  E.l  MMAE  Kalman  Filter  Codes. 


Code 

Filter  Model  Represents: 

FF 

fully  functional  aircraft 

WSM 

right  elevator  actuator  failure 

left  elevator  actuator  failure 

right  aileron  actuator  failure 

A4 

left  aileron  actuator  failure 

A5 

right  rudder  actuator  failure 

A6 

left  rudder  actuator  failure 

SI 

forward  velocity  sensor  failure 

S2 

angle  of  attack  sensor  failure 

S3 

pitch  rate  sensor  failure 

S4 

pitch  angle  sensor  failure 

S5 

sideslip  angle  sensor  failure 

S6 

roll  rate  sensor  failure 

S7 

roll  angle  sensor  failure 

S8 

yaw  rate  sensor  failure 

Each  figure  has  fifteen  averaged-probability  plots.  Simulations  begin  with  the  level-0  bank  of 
filters  as  indicated  by  the  single  codes  on  the  left.  As  the  first  failure  is  detected,  a  dotted  vertical 
line  indicates  the  filter  which  holds  the  declared  hypothesis.  At  that  time,  the  MMAE  switches  to 
the  level-1  bank  of  filters  with  the  filter  of  the  first  declared  failure  as  the  primary  filter.  All  other 
plots  except  that  of  the  fully  functional  aircraft  filter  switch  to  secondary  filters  of  the  level-1  bank. 
This  is  indicated  by  the  vertical  dash-dot  line  and  the  dual  codes. 

The  “stepping”  phenomenon  especially  evident  in  the  upper  right  plot  of  Figure  E.8.  This  is 
caused  by  the  averaging  of  ten  Monte  Carlo  runs.  The  “steps”  occur  where  individual  Monte  Carlo 
runs  have  failure  declarations  and  this  filter  is  re-assigned  the  maximum  probability. 
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Figure  E.l  MMA£  Performance  With  Fully  Functional  Aircraft  Eeulure  at  4.00  Seconds  Using 
Optimal  Dither. 
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Induced  failure  in  A1  at  4.00  s. 
Average  of  10  Monte  Carlo  runs. 
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Figure  E.2  MMAE  Performance  With  Bight  Elevator  Actuator  Failure  at  4.00  Seconds  Using 
Optimal  Dither. 
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Induced  faUure  in  A3  at  4.00  s. 


Average  of  10  Monte  Carlo  runs. 


Figure  E.4  MMAE  Performance  With  Right  Aileron  Actuator  Failure  at  4.00  Seconds  Using  Op¬ 
timal  Dither. 
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Figure  E.5  MMAE  Performance  With  Left  Aileron  Actuator  Failure  at  4.00  Second!  Using  Opti 
mal  Dither. 
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Imftjced  feulure  in  AS  at  4.008. 
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Average  of  10  Monte  Carlo  runs. 


_  ^ _  MMAE  Performance  With  Right  Rudder  Actuator  Failure  at  4.00  Secon 

timal  Dither. 
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Induced  failure  in  A6  at  4.00  s. 


Average  of  10  Monte  Carlo  runs. 


Figure  E.7  MMAE  Performance  With  Left  Rudder  Actuator  Failure  at  4.00  Secrmdi  Using  Op¬ 
timal  Dither. 
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Figure  E.8  MMAE  Performance  With  Forward  Velocity  Sensor  FUlure  at  4.00  Seconds  Using 
Optimal  Dither. 
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Induced  faMure  in  S2  at  4.00  a. 


Time  [sec]  Time  [sec] 


Figure  E.9  MMAE  Performaiice  With  Angle  of  Attack  Sensor  Failure  at  4.00  Seconds  Using 
Optimal  Dither. 


Induced  failure  in  S4  at  4.00  s. 


Figure  E.ll  MMAE  Performance  With  Pitch  Angle  Sensor  Failure  at  4.00  Seconds  Using  Optimal 
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Induced  failure  in  S8  at  4.00  s. 


Average  of  10  Monte  Carlo  runs. 


Appendix  F.  Dual  Failure  ProhabUUy  Plata 


MMAE  filter  probabilities  for  dual  failures  are  presented  in  this  appendix.  The  plots  are 
ordered  according  to  first  failure  induced.  For  a  complete  explanation  and  plots  for  performance 
with  right  elevator  actuator  failure  induced  first,  see  Section  4.4. 

For  convenience,  Table  3.4  is  repeated  below  as  Table  F.l  so  that  the  codes  in  the  plots  are 
easily  interpreted  as  the  indicated  filters.  Two  codes  next  to  each  other  as  in  A2S4  indicate  a 
secondary  filter  of  a  level-1  bank  which  hypothesises  two  failed  components. 

Table  F.l  MMAE  Kalman  Filter  Codes. 


Code 

Filter  Model  Represents: 

FF 

fully  functional  aircraft 

■a 

right  elevator  Ktuator  failure 

left  elevator  actuator  failure 

aw 

right  aileron  actuator  failure 

A4 

left  aileron  actuator  failure 

AS 

right  rudder  actuator  failure 

A6 

left  rudder  actuator  failure 

SI 

forward  velocity  sensor  failure 

S2 

angle  of  attack  sensor  failure 

S3 

pitch  rate  sensor  failure 

S4 

pitch  angle  sensor  failure 

S5 

sideslip  angle  sensor  failure 

S6 

roll  rate  sensor  failure 

S7 

roll  angle  sensor  failure 

S8 

yaw  rate  sensor  failure 
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Rret  failure  induced  is  A2  at  4.00  s. 
Second  ftiilures  induced  at  5.00  s. 
Average  of  10  Monts  Carlo  runs. 


Figure  F.l  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Left  Elevator  Actuator  Failing 
at  4.00  sec.  and  Each  Actuator  Failing  at  5.00  sec. 
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Figure  F.2  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Left  Elevator  Actuator  failing 
at  4.00  sec.  and  Each  Sensor  Failing  at  5.00  sec. 
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Rrst  failure  induced  is  A3  at  4.00  a. 
Second  taHuraa  induced  at  5.00  a. 
Average  of  10  Monte  Carlo  mna. 


Figure  F.3  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Bight  Afleron  Actuator  Failing 
at  4.00  sec.  and  Eadt  Actuator  Failing  at  5.00  sec. 
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F5 


First  failure  induced  is  A4  at  4.00  s. 
Second  failures  induced  at  5.00  s. 
Average  of  10  Monte  Carlo  mns. 


Figure  F.5  Dual  FVulure  MMAE  filter  Probsbilitj  Ploti  with  the  Left  Aileron  Actuator  Failing  at 
4.00  tec.  and  Each  Actuator  Failing  at  5.00  aec. 


Figure  F.6  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Left  Aileron  Actuator  Failing  at 
4.00  sec.  and  Eiwh  Sensor  Failing  at  5.00  sec. 
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First  failure  induced  is  AS  at  4.00s. 
Second  Mhjtea  induced  at  5.008. 
Average  of  10  Monts  Carlo  mns. 


Figure  F.7  Dual  FVulure  MMAE  filter  Probability  Plots  with  the  Right  Rudder  Actuator  FhUing 
at  4.00  sec.  and  Each  Actuator  Failing  at  5.00  sec. 
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Figure  F.8  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Bight  Rudder  Actuator  Failing 
at  4.00  tec.  and  Each  Sensor  Failing  at  5.00  tec. 
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Rrst  (allure  induced  is  A6  at  4.00  s. 
Second  faiiures  irxftjoed  at  5.00  s. 
Average  of  10  Monte  Carlo  runs. 


Figure  F.9  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Left  Rudder  Actuator  Failing  at 
4.00  sec.  and  Each  Actuator  Failing  at  5.00  sec. 
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Rrst  failure  induced  is  SI  at  4.008. 
Second  taiiures  induced  at  5.00  s. 
Average  of  10  Monte  Carlo  runs. 


Figure  F.ll  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Forward  Velocity  Sensor  Failing 
at  4.00  sec.  and  Each  Actuator  Failing  at  5.00  sec. 
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Figure  F.12  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Forward  Velocity  Sensor  Failing 
at  4.00  sec.  and  Each  Sensor  Failing  at  5.00  sec. 
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Rrst  failure  irtduoed  is  S2  at  4.00  s. 
Second  failures  Int^joed  at  5.00  s. 
Average  of  10  Monte  Carlo  runs. 


Figure  F.13  Dual  Fsilure  MMAE  filter  Probability  Plots  with  the  Angle  of  Attack  Sensor  Failing 
at  4.00  sec.  and  Each  Actuator  Failing  at  5.00  sec. 
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Figure  F.14  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Angle  of  Attack  Sensor  Failing 
at  4.00  sec.  and  Each  Sensor  ihiling  at  5.00  sec. 


Rrst  failure  induced  is  S3  at  4.00  s. 
Second  failures  induced  at  5.00  s. 
Average  of  10  Monte  Carlo  mns. 


Figure  F.15  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Pitch  Rate  Sensor  Failing  at 
4.00  sec.  and  Each  Actuator  Fuling  at  5.00  sec. 
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Figure  F.16  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Pitch  Rate  Sensor  Failing  at 
4.00  sec.  and  Each  Sensor  failing  at  5.00  sec. 
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Rr8tfsJlureindJoedisS4at  4.00s. 
Second  taiiuiBs  IndtMsd  at  5.008. 
Average  of  10  Monte  Carlo  runs. 


Figure  F.17  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Pitch  Angle  Sensor  Failing  at 
4.00  sec.  and  Each  Actuator  FUling  at  5.00  sec. 


F-18 


First  tsilure  induced  is  S6  at  4.00  s. 
Second  failurss  induced  at  5.00  s. 
Average  of  10  Monte  Carlo  runs. 


Figure  F.21  Dual  FVulure  MMAE  filter  Probability  Plots  with  the  Bx>ll  Rate  Sens(»  Failing  at  4.00 
■ec.  and  Each  Actuator  Failing  at  5.00  sec. 
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Figure  F.24  Dual  lUlure  MMAE  filter  Probability  Plots  with  the  Roll  Angle  Sensor  Failing  at 
4.00  sec.  and  Each  Sensor  Failiiu  at  5.00  sec. 


Rrst  taikjre  induced  is  S8  at  4.00  s. 
Second  tailures  inc&iced  at  5.00  s. 
Average  of  10  Monts  Carlo  runs. 


Figure  F.25  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Yaw  Rate  Sensor  Failing  at 
4.00  sec.  and  Each  Actuator  Failing  at  5.00  sec. 
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Figure  F.26  Dual  Failure  MMAE  filter  Probability  Plots  with  the  Yaw  Rate  Sensor  Failing  at 
4.00  sec.  and  Each  Sensor  Failing  at  5.00  sec. 
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